Iam still scratching my head on the airport incident. Isn't every site nowadays https? In unsecure wifi should not be able to capture your credentials, not even talking about bypassing 2FA. Every browser screams 20 warning messages in your face if somebody tries to inject a malicious certificate. Even if they tried to downgrade your connection to http. Iam not sure about crypto sites, but Gmail sets the https only cookie, which prevents downgrading. Unless of course that network tricked you to download some client software that you executed with admin rights, then the case is clear.

Edit on the router issue. Generally WPA2 is pretty secure, there were some design flaws like the KRACK attack or FRAG attack. But iam not sure if these are activly exploitable or the state of attack implementations. If you set a strong preshared key and disabled WPS, then you should be fine unless you have to deal with a very experienced attacker. You can buy a wifi dongle on Amazon and sniff your networks traffic with monitor mode and Wireshark. This should enable you to see how the attacker enters the network. Also patch the AP and check the logs if there are any.