Think of it as a spectrum of accountability. Networks run by businesses with a reputation to protect, hotels with password-protected guest networks, airline lounges, large malls, and chain cafes where you get the password from staff, are generally at the safer end. Completely open networks with no password, especially generic ones floating around tourist squares, train stations, and markets, are the risky end, because anyone can stand one up and name it Free_City_WiFi.
Verifying legitimacy is mostly about asking. Get the exact network name and password from a staff member or printed signage inside the venue, and be suspicious of duplicates, like a second network with the same name but no password. A login page that asks for a card number, or anything beyond an email or room number, is a red flag; legitimate captive portals don't need payment details for free Wi-Fi.
Even on the safer networks, treat it as semi-public: fine for browsing and maps, but do banking on mobile data or through a VPN.