There's a fairly simple counter-measure to prevent this sort of theft: they could pop up an SSL-based browser window on the corner of your computer that phones home once per minute. Once the window is closed, the connection is terminated. They do something vaguely like this with NoCatAuth.

As to the ethics of the hijack... you're on your own with that one. I figure market forces will eventually correct the situation. If you're the hard-charging business traveller, you'll shell out for a nationwide cellular data card (maybe $70/month, for all you can eat). So long as that's cheaper than airport wireless, the business traveller will go with the cellular solution.

That leaves people for whom the wireless is non-essential, and they'll vote with their feet.