I'm more worried about the corporate data-miners than street-level data thieves.
I just went into the WiFi setting on my phone to disable it from logging into any public networks...
Add the following to the list of possible snoopers:
Home Depot Public WiFi
Whole Foods Market
(those are just the big names -- many more small retailers and private networks in list).
...these and many others found in my phone as "Security: Open, Not Connected, Remembered" -- all I did was drive by or walk in a store -- I did not "try to connect", but my (Android) phone did -- and in doing so, provided any of these retailers with some data to mine if they choose to do so.