Once you connect to this fake network, the attacker can intercept the unencrypted data you transmit over it, including sensitive information like your usernames and passwords, credit card numbers, and other personal data.

So essentially the blog post says that you should make sure you only use HTTPS does with trustee certificates (padlock and no warning from the browser). This is good advice.

On the "your ISP can see what site you access" now I'm pretty sure that when we're talking about open wifi, which we are, they can register your DNS lookups, IP-addresses and ports used by your computer but that doesn't mean they automatic know who you are, especially if you never logged in with credentials that can be traced to your person.

While VPN, generally speaking, is a good solution it essentially just means that while you might use 15 different open wifi providers during a month (=inconclusive information about you spread among 5-15 different operators), centralizing all your internet activity to one single VPN provider (= extremely conclusive information about you) also has risks and a backside.

Good information on the "Evil Twin problem" but in my opinion the focus should be on educating people on how to recognize when the browser is connected to a site without a trusted certificate and what to do/ not to do then rather than promoting VPN.

An evil twin can easily fake the VPN service, popup a browser window with "https://ProtonVPNUpdate.ru" and a request the use to update the VPN client.

If the user fail t recognize that the site is running HTTP or HTTPS without a trusted certificate there's a risk that the user will follow the instructions from "Proton VPN" ("But it was their logo and it also had PayPal on the site....") and connect to the Evil Twin VPN Server.