Even if you use https to browse, metadata such as DNS and destination IP are going to be visible to attackers without VPN.
Should you be paying extra for a VPN just for public WiFi. Probably not, but if you pay for Apple iCloud+ or Google One, you should be taking advantage of the free vpn services that come with those subscriptions