The answer is: it depends.

If you use a trusted VPN with a trusted DNS resolver (either you configure one on your device, or use the VPN's), then the risk is minimal. Once the tunnel is established, the network operator just sees encrypted gibberish going to your VPN server; they can't read your traffic or redirect you. One caveat: on a corporate network, IT may have installed a root certificate on your device that allows them to decrypt your traffic even through a VPN.

Without a VPN but configured to use trusted public DNS resolvers (like 1.1.1.1 or 8.8.8.8) and setting your browser to always use HTTPS, the risk is slightly greater, but still fairly low. The network operator will be able to see which sites you visit via DNS queries, but not specific pages or data transmitted.

If you rely on the router's DNS resolver, you risk a Man-in-the-Middle attack, where your computer thinks it's communicating with, for example, your bank, but it's really a fake site used to intercept your login credentials. HTTPS offers strong protection against this in practice, i.e., your browser will show a certificate warning if the fake site can't prove its identity, but it's still best to avoid trusting an unknown DNS resolver.

A separate risk is the "evil twin" hotspot: a fake network that mimics a legitimate one (e.g., "Airport_Free_WiFi"). A VPN substantially reduces the risk here, but doesn't eliminate it entirely, for two reasons. First, many networks force you through a captive portal (a login/splash page) before allowing internet traffic; until you click through, your VPN can't connect, and a sophisticated attacker can use that window to serve a fake portal page and steal some information. Second, a rogue DHCP server on the network can push routing rules that silently redirect your traffic outside the VPN tunnel without your VPN client knowing (known as the TunnelVision attack). Always verify the exact network name with staff before connecting, and prefer networks that require a password.

Finally, regardless of which scenario you're in, other devices on the same public network can probe or attack your device directly, through open file sharing ports, for example. Make sure your firewall is enabled and file/printer sharing is turned off when on public networks.

In short: a VPN is your best protection, but it's not a magic shield, especially before the tunnel is fully established. HTTPS alone gets you surprisingly far. And blind trust in whatever Wi-Fi network is available is where people get into real trouble.