I don’t use a VPN, even on public WiFi, because I don’t use any unsecured protocols (except for occasional public HTTP). Am I being naïve?

Some open WiFi system inject JS Content into your HTTPS via MITM. This is a „service“ to show time left in free WiFi... and obvious not safe

Any resources how that works? To my understanding, this shouldn't be possible.

Private selfsigned wildcard cert on router, router is man in the middle, a lot of browser show cert error, but most people I saw don‘t care