Personally...I run a Linode VPN with openvpn on it listening on port 443.
Anytime I am on an public wifi or untrusted network (including the occaisonal time at my job with a personal device), i connect to that. Since its 443, its generally not blocked, even through the TLS connection is not "standard" because it uses a 2048 bit PSK to as a pre-cursor to start a connection, then a certificate based auth to establish the tunnel.
Its a full tunnel as well so all traffic runs through it. Google/Youtube will sometimes pitch fits and make me do captchas but otherwise its an easier way to shield from stuff like that.
All the wifi provider sees in that case is a single connection to my linode.
Admittedly this is a pretty technical solution though and requires some configuring. Mullvad would probably be an easier option with plenty of endpoints to jump through. Or you can run Tailscale and use SSH/socks proxies, though things like DNS leakage can still occur there.
I will use SSH tunnels and socks proxies for certain browsers that are configured to not store any data locally as well (ie: Firefox). I justify it easily in that I am constantly testing services and sometimes its best to rule out routing, BGP or other low level network issues and using ssh -D 12345 somethign@someplace allows me to do just that in isolated circumstances.