Malicious code inject upon Wi-Fi connection

[NoClueWhatImdoing]

First of all, forgive me for I am still kind of new to Cyber.  So here goes:

I recently read an article (https://www.webtitan.com/blog/wpa2-wifi-vulnerability/) that talked about a WPA-2 Wi-Fi vulnerability and the ability to "do malicious things" (my words) before a secure connection like a VPN can be initiated.  I've been trying to find other literature about an attack such as this and I am coming up short.  I'm having a discussion with someone about connecting to public Wi-Fi's at the moment and this has been my concern.  Everything that I am reading is saying that if you are using a VPN you should be fine.  But, seeing something like a Rubber Duck makes wonder if there isn't a way to do the same thing with something like a Pineapple.  I did a cursory search in the mods and didn't really see anything.  So to break it down:

1) Can you inject malicious code onto a device once the device connects to a device like a Pineapple or "Evil-Twin"?

2) Is operating a VPN on Wi-Fi also completely securing your Wi-Fi connection? (I understand that SSL does have vulnerabilities such as Heart Bleed)

 

Thanks!

[NoClueWhatImdoing]

"1) Can you inject malicious code onto a device once the device connects to a device like a Pineapple or "Evil-Twin"?" - I mean before the connect to a VPN.