Most of the hotspots are free, but free hotspots are not usually "protected" by a password, which serves also as an encryption key. Note, however, everybody at the site is using the same key.
I do on-the-road business through mobile wireless from the phone company. All traffic is encrypted between your phone/modem/hotspot device and the tower. What works for me is AT&T, which also gets me use of AT&T's paid wifi network, I get signed in using my own key even where the hotspot is "open" and free of charge.
You can get mobile + public hotspots also from T-mobile, you can get mobile from Verizon and Sprint. You can buy Sprint mobile wireless from Virgin for as little as $35 a month. StraightTalk, $42.50. Cricket, $45. AT&T $65. Verizon $100. All those are 2.5 GB to 3 GB data, unlimited talk and text.
I'm not sure whether anyone is still offering "data only" plans at low prices (Virgin once had a $30/month wifi hotspot), my data-only devices are all sharing with my phones, $10 a month each to be part of the shared data plan. You can go tablet-only for as low as $20 (2 GB) but the cheapest thing to connect a computer to the Internet is going to be in the $50-60 range for 3 GB to 5 GB data.
VPN service is going to be a cost on top of your Internet connection, which might be free. Not many "free" connections support VPN, although I've seen VPN service in hotels where the cost is buried in the room charge (like "free" HBO, "free" breakfast and "free" soap and shampoo).
My opinion about VPN, I don't think it is needed when I am using the mobile phone network as my connection, no more than I need it connecting hardwire through cable or DSL. That's based on my experience, my business. If I were doing other things, and concerned about the networks I was connecting too, then maybe VPN, and encryption/login codes that change every so many seconds. Used to do a lot of that when I was working internationally.