firewalls are not the only thing you need to think about.
Encryption. Hot spots generally don't use WEP or any other encryption mechanism because it's simply easier to setup that way. The coffe shop near me states that because they only have Barista's working and not IT people, they don't use any security. Even if you have the best software firewall available on your laptop people will still be able to sniff your wireless traffic with relative ease.
If you're VPNing into work that should cover your encryption. But until the vpn is actually established your network traffic will be easily readable, meaning, when you enter the login and password info for the vpn, anyone who really wants to sniff that info can