Because the Wi-Fi hotspot is providing your internet access, it can try to trick your device into accessing an imposter site. The VPN suggestion protects against this threat. Strong passwords protect against “dictionary” and “brute force” attacks, where someone (usually using rented “bots”) tries to guess your password, either using a dictionary of common words and passwords or trying all possible combinations of characters.
Source: latimes.com – Los Angeles Times