What the shared network can see
Hotel, airport, and cafe Wi-Fi are shared. Anyone on that network is closer to your traffic than a person out on the wider internet. Modern websites use HTTPS, so the contents of those pages are already encrypted between your browser and the site. A VPN still changes the picture for the local network: it sees a connection to the VPN server, rather than the list of sites inside the tunnel. Sites you open see the VPN server's address.
Connect before you sign in
Pages you load before the app connects still cross the open network. Join the Wi-Fi, open the VPN app, wait until it says connected, and only then sign in to mail or a bank.
A network name on a wall can point at a router someone else plugged in. The VPN carries what you send after it is connected. It does not tell you whether you joined the airport's network or a copy of the name.
The tunnel delivers fake pages too
A VPN will not catch a lookalike login page. If the address is a misspelling of your bank, the tunnel delivers you there. Read the address before you type a password. The same goes for a message that asks you to "verify the Wi-Fi" on a page you do not recognize.
When the hotel blocks the VPN
Some hotel networks block VPN servers. If the app will not connect, that firewall is a common reason. Mobile data, or another server chosen inside the app, is the usual next step. The provider's help page will name any port or server they suggest for restrictive networks. Trying random settings is a slow way to spend a layover.
On a network you trust, disconnect if you want the direct path. Leaving the app connected is fine too. It is a switch.