It's not really a concern anymore, now that pretty much all a lambda user's traffic is encrypted. Anyone collecting your wifi traffic only sees garbage.
Websites also can't be so easily spoofed. The spoofer would need to have a certificate issued by an authority trusted by your device for the spoofed domain, which is highly, highly unlikely to happen as long as your software is up to date, which nowadays is done automatically.
So really, the fear of untrusted public wifi is a thing of the past, and a good marketing lie for VPN companies.
No, they can't.
What some parties in the EU want is to force chat services provider to give them access to chat messages, which destroys the entire point of encrypted chats and essentially bans E2E chat encryption