Always is a strong word, but for anyone who regularly works from cafes, airports, and hotels, a VPN is cheap insurance and I'd recommend running it by default on public Wi-Fi. It encrypts everything between your device and the VPN server, which neutralizes local snooping and makes fake hotspots far less dangerous. For occasional light use, browsing and maps on HTTPS sites, the risk without one is modest, but sensitive logins deserve either a VPN or a switch to mobile data.
On choosing one: stick to well-known paid services with independently audited no-logging policies. Free VPNs are the one category to avoid outright, since several have been caught selling the very browsing data you're trying to protect.
One country-specific caution: a few countries restrict or block VPN services, and connections there can be unstable or carry legal risk, so check the situation for your destination and test the app before you travel.