They aren't completely wrong
I stayed at a big chain hotel beginning of last year in London. Pullman on Euston Road to be exact, the one next to the British Library.
Sat there bored in my room so decided might as well take a sniff of the WIFI traffic. It's a big chain, will be pointless though as it will be secure but I was bored.
Erm....what? You haven't turned WIFI isolation on!?! So I can now see all the other devices in the area. You haven't even secured the machines downstairs in the lobby you let people use. You haven't secured the, what appeared to be old control information server, for the boiler or heating system somewhere that according to the log hadn't been rebooted for a years. You haven't secured one of your iis servers. Just click Network in Windows showed devices that were visible! Jesus!
To give them a small, very tiny bit of credit. I reported it anonymously while there via Twitter and they started to lock it down while I was still scanning. Maybe I should of mentioned it openly to them, may have got a discount for the room :)
At a lodge I stay at a couple of Christmas' ago their whole WIFI was shockingly poor. The speeds were poor, you could see and connect to the printer in their office which was only a stones through away and no I never printed anything to it despite really wanting to. No WIFI isolation and you could even get to the router and if my memory is write, sign in.
Then we have Eurostar that I was on just before Christmas last year. Again, no WIFI isolation so you could see all other devices connected.
So NordVPN weren't far off.