[aptwebapps]

I just checked, and the default for creating a new S3 bucket through the console is not public readable. However, getting the right permissions in place for real-world work is not trivial if you haven't put some time in the docs so I suspect people end up shoving wild cards and the like in their access policies.