I'd argue that anytime you're in a situation where someone can inject themselves into the data stream between the user (you) and any server/service provider/content provider, you incur a higher level of risk than not.
First, let's look at the attack surface of your laptop (i'm assuming you're referring to a laptop here). Every computer can be a client or a server. In many cases, it can be both. There's increased risk when your laptop runs as some sort of server for an application because running as a server usually implies that the laptop is running a service that is accessible by someone. The risk becomes exaggerated when server software isn't properly patched or when there's a new attack vector that the vendor has not issued patches for. Do a Google search for services like BIND, Sendmail, SSHD, and you'll start to see that there are some vulnerabilities that are remotely exploitable. Fundamentally, this means that when your laptop is accessible by someone and there's a vulnerable version of some server software, then it's possible for an attacker to gain access to your computer. This access might be limited to certain parts or it could provide the attacker with admin (root) rights. It depends on the vulnerability and the service. Most OS's today usually come with some form of host-based firewall. However, some people tend to turn off firewalls. Some other people might open access to certain applications, especially if running a server service is authorized.
Second, another attack vector is network services. When someone can inject themselves into the data stream, an attacker can modify traffic in transit. Considering that most public hotspots don't implement high levels of security and wifi is provided as-is without any warranty. If you look hard enough, you may find the hotspot and trace it back to some sort of switch/router. In such instances, an attacker can easily inject themselves into the data stream and start sniffing sessions. A more advanced attacker could easily make themselves into a proxy and launch man in the middle (MITM) attacks where all sessions pass by their systems. SSL/TLS might provide data encryption, but an attacker that's injected themselves into the data stream could easily see the contents of encrypted traffic as well.
To answer your question, can someone hack into your computer and see what you've downloaded? It's certainly possible. But I'd argue that a malicious attacker will likely attempt to install some sort of malware on your system to extract more valuable data in the long term than a access list of downloaded software.
Is what you're doing risky? Yes - every action comes with risk. Any public network simplifies the launch of an attack. Consider the ease at which anyone can setup a wifi hotspot. You'll likely see wireless networks like "Free Wifi" or "Free Hotspot" in many locations. Many users are smart enough not to connect to those networks. However, what if you went to a coffee shop and saw a wifi network called "ATT" or labeled as some coffeeshop name? The same people that avoid "Free wifi" networks may choose to connect to someone that looks more official.
With that said, if you have host-based firewalls enabled, consistently patch OS and applications (i.e. Flash, Acrobat, Office, etc), use some sort of AV (not really effective against modern malware (i.e. 0day) but still affords some level of protection), don't enable unnecessary services, and perhaps use a VPN connection, the risk of compromise will be lower overall. At the same time, attackers are becoming more organized and are after money. So if you don't access banking sites, access or store data that is sensitive, or otherwise use the laptop in such a way to not access sensitive data, then you'll be at lower risk of losing important data (i.e. identity stolen, loss of corporate data, etc).