I've read quite a few articles about mobile phones needing VPNs while using public Wi-Fi, therefore, do they need VPNs on public Wi-Fi?
If you are accessing content only via https, that should be good enough even on a honeypot Wi-Fi, but there are vulnerabilities and some content is still unencrypted, so VPN provides an additional encryption on top, mostly due to privacy.
i never use public wifi! even not our enterprise network. what i have installed is a vpn provider extension for firefox for very rare use. i only need a hand with fingers to count the usage in a year. vpn is overrated, in special when using paid or registered services.
I find a VPN for myself works well for what I need. If you find not having one works for you then don't have one. The needs vary from person to person depending on their online habits.
I think a VPN is a good security improvement regardless of the OS and connection used. A VPN can increase privacy not only on wi-fi but also on mobile data as it prevents ISP from tracking online activity. This will prevent ISP from collecting data and selling it to third parties.
VPN raises not your privacy, it only gives you another ip, it also may fake your user agent. second may force wrong shown web pages, first do not prevent to read out browser features. some may filter ads, but thats a different thing.
jumping from a tower without bungee rope or parachute, would you do same, because its popular? read the description/features about our used vpn provider, compare with other vpn. for public wifi it really has benefit because the wifi provider normally cannot see your traffic, unless he breaks the connection -> MITM which is technically possible.
Some folks can't tell a public Wi-Fi from a fake one. Use your cellular connection, use a VPN, or be willing to sacrifice all of the data that passes through it. If for any reason any current email client would pass your credentials unencrypted you would be in a world of hurt if someone stole that info. As I've said before, once they get that, they change your password and reset the rest of your stuff...
Big providers like Google use OAuth so credential is token instead of password. Intercepting that token allows to read, write e-mail, calendar items etc, but it is not allowing to change password. Adversary would have to trick client into process of user authentcation again, which is not frequent and it should make user more alert.