Going by the same logic, what can a black hat exploiting this bug do if the target ISN'T using a VPN?
Using or not using a VPN in the context of this bug is totally irrelevant.
OP said "what would not being on VPN let someone do to you?"
not
"what harm could occur if you're not in the air?" or
"does using a VPN protect you from all harm?"
and the question/assertion is, "if you were in the air, and not on VPN, then could a black hat who's compromised your account spy on your traffic?"
And even if they could, any sensitive page should be using HTTPS, so the data will be encrypted. A VPN still wouldn't make a difference.