Not only that, but the iOS and Android APIs for HTTP requests make it really difficult to accidentally use unencrypted HTTP:

* By default, only secure connections are allowed

* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist

* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.

Let’s say a hacker hooks up the hotel internet to a firewalla and opens a free wifi spot. You log in and it sees from your traffic that you’re a customer of ABC bank and Gmail and ATT from the traffic - next thing you know you get a text message from your “bank” that someone has stolen your credentials in “XYZ Arizona” and you have yourself a phishing attack. The exposure scenarios are only limited by the imagination of humans and modern LLMs.

I've also argued this on the past, it just seems redundant, but people eat the VPN ads like they were gospel.

I just use my home router as VPN to not care if the 100 apps om my phone have a working encryption. I also use it to access my home services so that they are not exposed to the internet. I also use it to limit exposure on my VMs on a cloud hoster.