No, joining a public network doesn't give its owner or other users access to your photos, messages or files. A Wi-Fi network carries traffic; it can't open apps or browse storage on a modern, updated iPhone or Android phone. Both systems block incoming connections by default and sandbox apps from each other.
What a network can do is narrower:
- See and steer your traffic. A hostile hotspot can watch which domains you contact, redirect you to a fake login page, or show a bogus "update required" screen. The damage comes when you type a password or install something, not from the connection itself.
- Identify your device on that network. Apple phones use a different private Wi-Fi address for each network (rotating every two weeks on open networks), which limits tracking across locations. Android does something similar by default.
- Reach services you've left open. Anything listening for connections, like AirDrop set to Everyone or a file-sharing app, is visible to people nearby.
Actual remote takeover requires an unpatched software flaw. These do exist: the NSA's public-settings guidance cites the BlueBorne Bluetooth bugs, which could give an attacker full control of vulnerable devices, and recommends turning off Wi-Fi, Bluetooth and NFC when you're not using them. Such exploits are expensive and rarely spent on random travelers, and updates close them.
So the practical defenses are simple: install updates promptly, keep sharing features limited to contacts, and never approve an install or profile a Wi-Fi page asks for. If you don't trust the network operator to see your traffic at all, a VPN hides it from them.