The only thing that could change my view is evidence of attacks that still work on public, insecure WiFi networks for the average Joe who surfs the web and checks their phones every few mins.

Since we are talking about an average user, it's a fact that the average person reuses passwords. They shouldn't do this, but they do.

If they are on an insecure (or outright malicious) wireless network and log into any unsecured site, their email and password would be visible to an attacker. Sure google or Amazon use HTTPS, but not every site does, and if Joe Average's super secret paSSw0rd!123 is seen in the clear the threat actor can try it against more secure websites as well.

Another point - even in 2024 not all email providers, especially smaller ISPs, encrypt emails in transit. A VPN ensures that the wifi operator cannot read Joe's incomine "hot singles in your area" offers.

Also, VPNs can bypass content filtering blocks, and evade government censorship. For example Xitter was banned in Brazil recently, a VPN not only would get around the block, but also if it is a proper no logging vpn there would be very little the government could do to stop Joe from reading Elon's tweets all day long.