It still has to add up to something significant if you want to make real money at it; stealing a few pennies here and there is not that lucrative. A typical recent-gen CPU mining bitcoins full-time is worth about $0.02/month. If you assume your AP is in a busy enough location that you can average 100 people connected, you'll manage to nab $2 of people's CPU time each month. To get anything significant it seems like you'd have to actually compromise the machines long-term, not just inject some JS into pages as they're browsing.