Wi-Fine

I was trying to explain this to someone recently and basically described the same.

However, there’s still a privacy risk on a public wifi, correct? As in your neighbor can see the DNS requests (as those are generally unencrypted).

If you use a VPN, cool, but now your “free VPN” gets to see that.

The only other issues I could think of were ARP poisoning / spoofing and maybe local phishing redirects

A fair amount (DNS, etc) is still in the clear, yes.

I still see a good amount of clear text web traffic when I do packet captures in airports and the like.

Usually image or media files, but the odd time I see some badly conceived automatic update process pulling an exe or msi over plaintext HTTP.

Set your browser to HTTPS only mode (a setting in all modern browsers) and you'll be Mostly Safe (TM). Also enable DoH (using your own server, if you don't trust public ones) and you'll be Even More Safe (TM).

Yes, you're exposing yourself to some random people on the network who may try to attack your laptop or phone, but as long as you enable your firewall you're Probably Fine (TM).

I'd avoid using public WiFi if you're a government agent or working with highly sensitive data just in case. In all other cases (i.e. 99% of people using their laptop in public) it's perfectly safe if you just don't disable your device's security mechanisms.

In this space, if you have WPA3 then there's no benefit to having a "password" for WiFi which actually is public knowledge.

In WPA and WPA2 the password means network use is encrypted, which means a completely passive adversary can't just snoop the network so long as there's a password.

But in WPA3 even without a password everything is encrypted anyway, your station says "Hey, I'm joining this network here's a number" and the AP says "Welcome aboard, here's a different number" and now you've got encrypted networking. Obviously with no password the AP could be an imposter, but passive snooping is impossible.

On the other hand, if you're dead set on identifying users, there's no substitute for the Enterprise WiFi behaviour all the way from WPA onwards where users have a username and password, doing this locally for your home WiFi is very annoying, but at scale it's convenient yet able to be responsible. The entire world's academic community have a single such network EduROAM, if you're an MIT student and you happen to be in the library of a Polish university, your WiFi just works, or if you're a Cambridge professor giving a talk at the University of Sydney in Australia, same deal. The institution where you're a guest knows your identity (often email address), but doesn't see your credentials (password in most cases), it's trusting your home institution to validate that identity.

I think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.