Describe an average persons “threat model”, in addition what mitigations would you recommend for the “average” person who might bank abroad or login to a corporate intranet?

Unless you are using WiFi that uses captive portal with a forward proxy( re-minting https certs). This would be doing full packet inspection ( clear text ) of your traffic, probably not happening but just be careful or just use you cell hotspot and avoid public WiFi all together.