How can I have Android automatically connect to a VPN only when on an unsecured WiFi Network? Let's say I want to connect to a WiFi hotspot, but it is unsecured. I'd like to connect to a VPN server, but only if I'm on an unsecured WiFi network. If I'm on a secured network or data, I'd like it to stay in VPN off mode.
I don't think any app can do this, given that you want to run another app or script to connect to a vpn based on conditions of open/secure WiFi 

Hence, you need to look at automation, I prefer MacroDroid ,being easier to learn-that's why I use it :-), and free version offering creation of upto 5 macros.

Coming to the solution, approach is based on this logic


Connect to an open network only if not connected to secure network.
You have a list of open networks to start with, which can be manually updated. Detection of a new open network and dynamically updating list of open newtworks is creating complexity , since you may not want to connect to any available open network for reasons like- how long it permits your session, ease of logging into it, stability, speed amongst others.
You have an app of your choice to create a VPN connection.


The macro would look like this.  I have tested only once , since there are no open networks around where I live.  The app used for creating VPN was VyprVPN. That is the app site link. My PS is not connecting to give you PS link . This app also gives you option of connecting to untrusted networks automatically, once you enter the network name. Connection beyond a limit is subscription based.

Trigger

WiFi enabled (macro will only trigger if any WiFi is connected)

Actions

Wifi connect to network> configure> connect to network> select all open networks from the list ( you have connected to these in the past and show up on your cell)

Wait 30 Sec (wait before next action, configurable)

Launch Application . From the drop down menu choose preferred app to create VPN

Constraints

WiFi State > not connected to network> from list choose all secure networks

The macro gets triggered only when WiFi is enabled, and actions executed only when the constraint is TRUE, meaning you are not connected to any securenetwork. It then connects you to open WiFi from the list of open networks and after a pause launches the application to create a VPN 

This is the skeleton macro and can be tweaked for optimal performance after testing and you may like to add additional things like sounding an alarm, announcing that you are connected to open network, popping up a notification etc. 

Hope this solves...all the best