Advice about public wi-fi has been repeated for so long that most of it now describes a world that has largely gone. The classic warning - that somebody on the same network can read what you are doing - was a real and serious problem when most websites sent information in plain text. Today nearly all traffic between a device and a website is encrypted, including banking, email and every ordinary business service, and that encryption does not care whether the network belongs to a café, a hotel or a stranger. Someone watching the network can generally see which sites you visited, not what you did on them.
That does not make working away from the office risk-free; it means the risks are different from the ones people have been told to worry about, and the difference matters because effort spent on the wrong risk is effort not spent on the right one. The most reliable way to lose something in a café is for a person to see it - a screen with customer details facing the room, a password typed in view, a confidential document open while someone reads over a shoulder. This sounds too simple to be the real answer, which is precisely why it keeps working.
The second genuine risk is the device itself rather than the network. A laptop left on a table while you fetch a coffee, a bag under a chair, a phone on the table by the door: these disappear, and what leaves with them is everything the device was signed in to. A device that locks itself quickly, that requires a password or a fingerprint to wake, and that has remote erase switched on turns that loss into an insurance matter. The same device without those things turns it into a business incident.
The third is being asked for something you should not give. A network that demands an email address to connect is ordinary. One that asks you to install something, accept a certificate, or sign in with a work account is not, and the answer is no - closing the browser and using a phone's own connection instead. Sharing a phone's connection is, in general, a better default than any public network anyway, and it is simpler than the alternatives people are usually advised to set up. The short version: encryption has handled most of what the old advice warned about, and what remains is physical - the screen, the device, and the request that does not smell right.