It is not peer to peer. You are connecting to somebody else's Wi-Fi router to get to the internet and you go through their ISP.

So, a very simple man in the middle of attack would to be put up other Wi-Fi connections that look legitimate but are in fact somebody's laptop hanging out in your location and now your communication is entirely visible, unless you're using a vpn.