To answer the stated question- if Alice doesn't arrive at a hotel until a week after Bob has left- or, really, if she arrives at the moment just after Bob finishes his sensitive business- then it is unlikely that whatever nefarious activities Alice undertakes- in the context of targeting guests- will compromise Bob.
Schneiers first law notwithstanding, it would be unusual for a hotel to be capturing and storing traffic, and it would also be unusual for Alice to target that particular repository of data, should even she know of its existence. People currently at the hotel are going to be much more interesting targets, as their presence offers more opportunities to enable them to be compromised.
Phishing in general is far and away the most common method of compromise, and most compromises that occur are, from the perspective of the attacker, simply opportunistic commercial transactions. Guests staying at a hotel can reveal a lot of information about themselves that can be employed to convince them to open an email with an appealing and seemingly trustworthy offer- one that perhaps even appears to have been sent directly from hotel staff. Not to belabor the metaphor but hotel ponds are well stocked.
Of course, sensitive information about Bob will be stored in the systems the hotel uses to conduct its business, which include software to store and manage payment data as well as guest contact information, preferences and any notes made about their stay by hotel staff. Should Alice target and compromise these systems then Bob's information would be exposed to her.
On the general topic of hotel hygiene- for all intents and purposes, internet services at a hotel are like other shared services like pools and restaurants- amenities targeted to a captive audience. Cleanliness, quality, and other attributes are not necessarily competitive requirements. Internet services are no different.
Hotels have also always drawn elements looking to take advantage of guests- who are unfamiliar with the area, who aren't staying long, who have schedules and logistical constraints that prevent them from following up on inconveniences, and who on vacation often have their guard down.
Of course, you are not likely to be robbed at a large hotel in a major US city, and you are similarly not likely to have your credentials stolen. But if you are inclined to take precautions, you are not crazy for doing so.
From a practical perspective:
- If you have a sensitive service provider who for some reason does not require https, find another service provider
- If you travel and frequently have to do business over public or hotel wifi, for email and other sensitive accounts find providers who support 2FA https://twofactorauth.org/
- If you have to check credit card or bank accounts from a hotel and don't have 2FA and you are worried about it, prefer getting a network connection from your phone by tethering over using the hotel network, either wired or wireless. It likely doesn't make a difference in any specific case, but generally speaking cell data networks are more safe.
- Tor and VPN are not better than https on the specific issue of protecting credentials. All of those tools protect the content of your communications. What Tor and VPN also do is prevent someone monitoring network traffic from knowing whom you engaged with in those communications. With https, someone watching network traffic can tell that you had a session with Bank of America that started at 2pm and lasted for 15 minutes, though they can't tell what credentials and other data you exchanged. With VPN, someone watching network traffic can only tell that you connected to your VPN provider at 2pm, not whom you communicated with over the VPN. Only your VPN provider knows that. And with Tor, outside of state actors, no one monitoring the network has any idea what you did.
