Remember this isn't an ipad/iphone problem or question, but any computing device (laptop for instance) using public wifi.
On how prevalent, I have no idea. Not even sure how it would be reported, i.e. if your CC# was taken or email compromised was it that wifi hotspot you used? That waitress that skimmed your CC#? Some breakdown at some other business you placed an order with? Who knows.
On how easy is it, that depends. VERY easy to do a man in the middle attack where you sit on a public wifi and act as the intermediary between the secure website and the client. You have to be able to pose as both the server and the computer, but there are apps out there to do just that you can dowload and run in 5 minutes. Now, the cheesy ones, while easy to use, would at least cause the client's browser to pop up an "invalid SSL certificate" type error message, but some people click through those as they don't know what they mean and/or their browser/security settings don't even throw those up.
If you always use SSL, practice good browser/security hygiene, have an updated software firewall running in the case of a computer, and only visit sites that have correctly implemented SSL certificates your risk is likely much lower. But how do you know if the site is implementing SSL correctly or there isn't a more dedicated hobby hacker
with a more sophisticated man in the middle attach that doesn't throw up such an obvious security message?
Running with a VPN when you do transactions (or probably email) is fairly painless and provides a level of comfort. Of course, if there are lots of people on the wifi connection, and others don't have a firewall, are using non-ssl email, etc. etc. they are going to be the targets, not you who are a little more cautious.
Its all what you consider an acceptable risk. If you use public wifi a few times a month, then making sure you use SSL may be sufficient for checking your email. If you are using public wifi on a daily basis no way would I rely on just SSL to protect me.
