Hotel WiFi, or indeed any other public WiFi such as the ones found in airports and coffee shops, should always be approached with caution, it is relatively trivial for an attacker to set up a fake access point.
In 2015, cybersecurity firm F-Secure conducted an experiment on the streets of London – creating a fake hotspot to see how many people joined without question. In one half-hour period, a whopping 250 devices connected to the hotspot, the firm later revealed in a report. One of the terms and conditions of the hijacked hotspot's use was that the user must give up their first-born child or most beloved pet in exchange for the internet. Six people agreed.