While I'm at a coffee shop, I want to protect my data from inspection and manipulation, including destinations. In other words, the barista can only see that I am using bandwidth and cannot (meaningfully) manipulate or redirect me. So I find a VPN (tunnel) provider that I trust. I still see two potential issues:
Bootstrapping. I need to sign into a captive portal, often over http, to get internet access in the first place. Surely until I establish the VPN connection my communication is vulnerable?
Redundancy. If I use secure protocols for each task (https, sftp, ssh, Tor, encrypted XMPP...), surely my connection is just as safe without a tunnel?
Is there an implementation detail I'm missing? Or is it a matter of convenience (once the tunnel is established, I don't have to confirm each and every subsequent connection is secure)?