A not-security-geek question

Yes, an unencrypted 802.11 network is trivially sniffable, whether or not it uses "captive portal" logins.

However, an encrypted wifi is not very much better. WEP is completely broken against eavesdropping even without the attacker knowing the passphrase. WPA is effective against eavesdroppers, but (AFAIK) anyone who knows the PSK can still decrypt captured WPA traffic.

There are more sophisticated variants of WPA (labelled "Enterprise" in the jargon of the trade), but they're significantly more difficult to set up and a total non-starter for the coffeeshop/hotel use case. (They generally require a SecurID-style token of some kind.)

And finally, yes -- a VPN, encrypted tunnel, or application-layer encryption system such as HTTPS is more secure.