Part of your answer depends on how your ISP allows you to connect to the Internet.
First consider the security of the device itself.
From the ISP side facing the Internet: If your hotspot is given a public IP address either permanently or temporarily it would be susceptible to attacks from the Internet, and while on-line it would likely get indexed in major vulnerability scanning projects like shodan.io or scans.io at some point (Note: you may be able to find similar devices like yours on sites like shodan.io). Likewise during these times your hotspot was on-line it could potentially be susceptible to attack, especially if no one is regularly going through efforts to secure it.
A quick way to check your security would be to determine your own IP when using the hotspot then perform remote testing against the IP in use and check to see if there are any signs that you can connect to it directly (insert long conversation here). Please note depending on where you live it may not be legal to test this either.
From the wireless side: This will vary a bit more based on the protocols both in use at the time and also the protocol supported by the device over all. You may access it using a more modern cipher in a secure fashion but the device itself may support many weak protocols which may enable an attacker to perform brute force attacks to access it. More importantly a LOT of these devices support web servers on their internal wireless network which could easily be attacked. Finally since the devices TCP/IP kernel is essentially accepting wireless connections from anyone around you it could also be attacked directly (this is far more difficult to do but it is a distinct possibility).
Second, consider how you are using it. What protocols does the device use to connect to the ISP ? are these secure ? does it fall back to insecure protocols when it can't connect to it's primary connection ? Does the device support roaming ? Similarly what protocols do you normally use to connect to it, could your connection be downgraded by an attacker, what's the weakest protocol supported, and do the weaknesses in the worst case scenario allow for an attacker to be able to sniff your traffic ? Do you trust the firmware of the device ? The software ? Where it calls home to ? All the protocols it uses ? Does your ISP track and monitor your connections and things like DNS requests ?
Third, how do you verify you are actually connecting to your device first ? Is it possible that someone nearby with a wi-fi pineapple could be intercepting your traffic then forwarding it on ? Do you verify that you are connecting to the correct device each time ? Do you have any type of certificate authentication in place ?
Basically, the security of these devices are not ideal especially if they don't receive regular security updates from the ISP (rare at best). That said they may not be much worse than any other random wi-fi connection you use anywhere else. If you have serious security concerns you should assume the worst and simply think of it as part of the untrusted Internet and leverage things like VPN's to minimize the risk where possible.
There are many other components about a secure connection that I am not including here (long conversation) but this will help you assess the risk areas and some of the attack surface for such a device.