It is Blizzard's position that the session ID hijacking claim is bogus. Bashiok stated in his post that thus far none of the compromised accounts they have investigated had an authenticator attached prior to the compromise. A further update specifically asserts that the session hijacking being described is technically impossible.
The advice to use an authenticator was repeated in a cut and paste response a few hours after the original post, and again a day later. The assertion that no authenticator enable account has been hacked was reiterated in a response to a user here.
The Bliz forums are painful to read and it may turn out the some vulnerability will be acknowledged in the future but at the moment the official stance is that an authenticator attached to your account, along with traditional antivirus/firewall protections are sufficient.
There is no acknowledged evidence that public games pose any threat whatsoever. The primary cause of account compromise continues to be compromised passwords (whether by social engineered attacks, weak passwords, keyloggers, etc).