For years I've always suspected either hotel staff managing the wi-fi or nearby neighbors could be tapping into the hotel wi-fi traffic, which is almost always unencrypted, which is why I either use my own phone as a hotstop with encryption or, less frequently, at least use VPN. It's literally like doing business on a computer in a public cafe. Assuming less risk is just a mistake waiting to happen.