The real risk on open networks
Anyone on the same network can watch unencrypted traffic and see which domains you reach, even when the pages themselves are encrypted. Captive portals and rogue hotspots can also redirect your DNS lookups.
What the tunnel changes
With the VPN on, the network sees one encrypted connection to one server. Your DNS lookups go through the tunnel too, so the hotspot cannot read or redirect them.
Why a kill switch matters here
Hotel and airport Wi-Fi drops constantly. Without a kill switch, a dropped tunnel silently exposes your traffic. With one, traffic stops until the tunnel is back.