In Germany every public wifi, train (ICE windows block cell internetand they are currently lasering small waves in them), hotels, cafes, private wifis even if you are a guest.
Because of “data protection” everyone needs to accept TOS so every network has them.
No idea where you live but cell data is often expensive.
I just use the MullvadVPN app, my systemd-resolved is plain and insecure and Mullvad does all the secure DNS stuff. Obviously sucks and is not scalable at all.
Systemd implementing a switch that could then be integrated into GUIs, like KDE6’s captive portal opener, is crucial. So for the portals you would make the DNS insecure, log in and secure it again. Best automatically.