When the droid switches from 3G to connect via an open wiFi, does it connect over a VPN or some other secure tunneling protocol? (Especially important when you are in a public wifi)
The 3g will use the security of the wireless access point you're connecting to... If it's a public, un-secured AP then there is no security, if it's protected by 40-bit WEP, then you have 40-bit WEP encryption. It's exactly the same as a computer connecting to the wifi.
There are VPN apps, but judging by your question I don't think you understand fully what a VPN is (That's not a bad thing, it's a weird concept to wrap your mind around).
Not to the access point. As stated above, the access point dictates the security used. You can certainly connect via VPN once you are connected to the AP though.