A public WiFi is not much different than using any other Internet Service Provider. And the question to ask is always the same: can I trust this enough for that action?. The real answer then depends on a lot of parameters:
- the sensitivity of the data exchanged - the bank website is sensitive
- the WiFi provider - large hotel companies can probably be trusted, they would not like being involved in fraudulent bank sites, and should be able to secure their WiFi access, unsure for smaller organizations
- the security of the SSL handshake: if you control that the domain in URL address bar is the correct domain and your browser validates the certificate, you should trust the connection - I do not even imagine that you could not use HTTPS...
IMHO a VPN adds little security per itself. If you think that the WiFi hotspot can fake your bank web site, why could not it fake a public VPN (*)? It would be certainly different for a corporate VPN, because strong authentication is normally required between the client and the server and a MITM attack is likely to be detected by at least one part.
(*) If you are used to securely control that you are connected to the correct VPN entry point, you should be able to trust the connection too. What I mean is that using a VPN you are not used to will add no security because it could be faked, without you being able to detect it.