To answer your questions:
I would imagine that either the router is just set up that way to be convenient, and so that you can contact help if the thing isn't working. That's my theory, I really have no idea why you would do such a thing. It sounds like a bad security practice to me, but also a purposeful choice.
You really shouldn't be doing your bank transactions on public WiFi, period. It would be nice if this router provided you with an additional layer of security, but in reality you should be doing your banking from access point you control. What if the router itself is compromised?
Whenever you connect to this router, you have no idea whether you are connecting to the real router, a copy cat, or the real router after a compromise. Maybe your comfortable with the risk, but I'd rather take my chance at home.
Man in the middle attacks. All the attacker has to do is to masquerade as the router and let someone connect. If he can't find anybody about to connect, that's fine. He uses a deauth attack to knock everyone off the router, and impersonates it as everyone pops back on. You might not notice yourself popping on and off
Here is a guide (a bit dated) on how this is done. The point is that whatever the router is doing for security, you still have to connect to the darn thing, and that's when you get nailed anyway.
Some people call this one-two punch of deauth and impersonate the "evil twin" attack.
Another thing an attacker would do is simply compromise the router. This isn't as hard as it sounds - many routers have very poor security. The access points will often have weak passwords, or default passwords. Many times custom software from ISPs is of poor quality, and allows remote exploits.
Or you know what, scratch that: How about the attacker just approaches the router, opens up the case and modifies the firmware to do his bidding? No remote exploit needed there. For public WiFi, this is a very real concern.
VLAN's only protect you while your connected to the router. You still have to connect to the thing, and that's where the bad stuff happens. I almost forgot to mention that VLAN hopping is certainly a possibility here:
Why do people tell me not to use VLANs for security?
- Only use Access Points you trust for critical operations
- Always use HTTPS, all the time, under all circumstances, no matter what, or else.