Ian,
You said: Stealing credit card info is only one potential bad thing. Stealing your list of e-mail contacts for a spam run... Setting up a trojan so that your machine becomes a zombie for either a DDos attack or a potential way to get around a corporation's firewall.

And you're quite right! But the question I'm asking isn't "why would someone want to compromise my machine?" - instead, (read the original article!) "Why would a bad person use a hotspot to compromise my machine?"

To compromise a machine, steal emails, or discover a way around a firewall, there's an easy way, and there's a hard way.

The hard way is to set up a public wireless LAN access point of your own, disguised as a genuine hotspot, then access a couple of dozen machines, none of which may be the ones you want, while running a severe risk of being physically arrested.

The easy way is to use the wide array of Web bots, operating from an indetectable location in the Ukraine or Iraq by proxy, and scanning millions of PCs around the globe.

The only reason anybody would try the "hard" option, is if they had a specific target in mind. And even then, it would be far easier to hire a thug to steal that person's PC, than to go to all this trouble.

It's a bit like "bluesnarfing." Sure, it can be done, but the effort is completely out of proportion to the reward. You might as well fly to Colombia, hire a car, drive to a supermarket, buy a half pound of local coffee beans, then fly home again, in order to get "genuine colombian coffee" as fresh as possible.

Yes, it's perfectly possible, technically; but in reality, it's just not going to happen.