I don't know about other Canadian cities, but in Vancouver, there are both Telus and Shaw hotspots randomly strewn throughout the city. The Telus ones exist in public/government buildings as a co-sponsorship with the municipal government; the Shaw ones exist at the numerous charging stations for bike-share bikes, as a different co-sponsorship. Admittedly, you aren't really likely to run into either if you're not downtown.
Then there's the Shaw hotspots which they expose on a dedicated side-channel of the routers of people who pay for their business Internet plans, which allow arbitrary other Shaw customers with authenticated MAC addresses to connect to them. Those are all over the place, and it'd be pretty easy to steal a list of a few hundred registered MACs and rely on that network to connect.
