The logins to sites like Google use one of the modern authentication methods. Often OAuth.
These use tokens issued by the site to your browser to indicate that you have logged in. There are typically 2 timeouts for authentication on these sites.
There may be a login timeout. This may be updated when you do something active on the site or it may be a fixed timeout. Generally measured in days, sometimes weeks or months. When it expires, you have to put your login credentials back in.
On top of that, there is a token refresh timeout. Tokens are typically short-lived since that reduces the amount of work the servers have to do to check that the browser using the token is the one it was sent to originally. The token is checked on each page refresh (sometimes via socket connections as well) and can be refreshed by the server during those interactions. If the token expires, the server will typically recheck your login credentials and issue a new token without your interaction if it thinks the credentials and the browser are still valid.
This is what lets you have extended sessions with a service without having to log in all the time. You will note that banking and finance services don't allow extended sessions as they are certainly less secure. But with careful processing, it can be a fairly safe mechanism and is used, for example, on Azure & AWS management portals.
So, to your question. There is reauthentication going on. A secure service will check that the token is coming from the originating IP address and if not, will force a recheck of credentials (which doesn't necessarily mean a new login for the user). But all of that happens over HTTPS (TLS) and so should be invisible to a Wi-Fi based hacker.
I say should because there are lots of ways for this to go wrong. The service may not be validating tokens correctly for example which can lead to token replay attacks (though that needs something to have access to the token from your browser). You could be subject to a Man In The Middle Wi-Fi attack which intercepts your TLS connection. Browsers are generally better at reporting on these now, if you get a warning to say that there is something wrong with the certificate for a site while you are on Wi-Fi, that is a pretty good indicator of a MitM attack happening. There are also various ways for the service to have messed up the configuration of their TLS making it weaker.
For security, you should always use a good VPN (there are many really poor ones) and have that turned on from the outset.