You disable the VPN, they show “unprotected”, come on, I’m not really unprotected, why such a dramatic word, I just disabled the thing a little, I’m “disconnected” but it doesn’t mean I’m actually unprotected, the same way it doesn’t mean I’m actually protected if I’m using a VPN.
It is not peer to peer. You are connecting to somebody else’s Wi-Fi router to get to the internet and you go through their ISP.
So, a very simple man in the middle of attack would to be put up other Wi-Fi connections that look legitimate but are in fact somebody’s laptop hanging out in your location and now your communication is entirely visible, unless you’re using a vpn.