Hotel Wi-Fi is a shared network. Every guest, every conference attendee, every person in the lobby with a laptop is on the same network as you. On a flat network, devices can see each other. An attacker can run a passive sniffing tool and watch unencrypted traffic from everyone connected.
Most modern HTTPS traffic is encrypted end-to-end, which helps. But apps — especially older, niche, or corporate apps — don't always use proper encryption. And HTTPS doesn't protect you from a rogue captive portal that serves you a fake login page when you first connect.
Use your phone as a hotspot if you're doing anything sensitive: banking, work email, VPN credentials, anything you wouldn't want a stranger seeing. Your phone's LTE connection is encrypted between your device and the carrier. Nobody in room 412 can reach it.
If you're traveling internationally, be aware that some countries have national-level surveillance infrastructure. Using a VPN in these contexts isn't paranoia — it's standard operational security for journalists and anyone handling sensitive information.