Public Wi-Fi used to be genuinely dangerous because much of the web was unencrypted. Now that nearly all traffic is encrypted end to end, an eavesdropper on the same network sees which sites you visit, not what you do on them.
The remaining risks are different. A rogue access point named like the café's real network can intercept anything not properly encrypted and push convincing fake sign-in pages.
Captive portals — the sign-in pages hotels use — routinely break secure connections deliberately, which trains people to click through warnings that should never be ignored.
For most people the practical measures are modest: keep software updated, avoid file sharing on unknown networks, and use a phone hotspot for anything sensitive.