There really isn't a finite answer here. A Wifi showing a lock is promising some sort of encryption, but this encryption is covering the over the air transmission only. WPA2 is a generally better mechanism than some of the earlier encryption mechanisms (you may see this as part of the description of the network) but the bigger problem is that you really don't know what's sitting behind the wireless router that is offering you connectivity. You have to figure that the average coffee shop or hotel is not putting a huge ton of money into keeping their network spyware free.
When a shop offers measures like passwords, click through web pages that make you accept terms and conditions or other add-on measures - their big driver is really business - they want to make the wifi available to customers who are paying them money and they want to protect themselves from lawsuits (thus the terms and conditions). It's a good sign to see this, as it means someone put a little thought and effort into thinking through the configuration, but it's by no means a perfect guarantee.
General protection measures are recommended by many companies and fall into the following categories:
- keep your software up to date - since the network isn't going to screen spyware for you, make sure your defenses are good.
- have virus scanning and a personal firewall if you are concerned about your data and your system's integrity
- when using a work computer, use any VPN client you are given - it never hurts to use it even for default browsing, as it means your traffic will be routed through the network and some level of privacy is being applied.
- don't do unsecured transactions of sensitive data - always make sure HTTPS or SSL is on when you're sending a credit card, personal info, or other information you want kept private.
I'll admit, it is likely to be more a gut reaction than anything, but I feel a little better using a big business wifi than a smaller business - for example, I'd feel pretty sure that Starbucks has concocted a fairly regimented way of providing wifi at all locations that involves a least a reasonable attempt to keep malicious junk off their network. Similarly I feel a little better on branded wifi - for example, you'll notice that all Starbucks use attwifi - AT&T is their host. AT&T would prefer not to have their network gear compromised, so I figure they have probably taken a few standard steps to keep their infrastructure patched and up to date. I'm still not going to be lax about the steps above, but I'm less likely to consider this as huge a risk as Mom&Pops diner with a wifi that shows the out of the box name of the product and no password at all.
And one last non-technical caveat - don't underrate shoulder surfing. It's far easier to snoop the top of someone's desktop than to go to all the work of hacking a network. The great thing about wifi hot spots is that you know people may be using computers near them.