It sounds more like the customer should set something to private but chose not to. Just like if you set your S3 bucket to public you wouldn't blame Amazon for not keeping your data private.
It's better now, but Amazon absolutely deserves blame for historically making it extremely easy to accidentally make S3 buckets or files within buckets public.
I might be in the minority but I never found the old UI to be confusing. Public buckets were never the default and it was pretty clear when you were making the change. It's good they are making it more dummy proof but I'm not sure it is fair to say they deserve blame
As a sidenote I actually find all the new warnings and stuff annoying (but I'm not saying it isn't worth it all things considered). As a developer I'm quite used to having to pay attention to details already - one typo can be disastrous and there might be no warning (you might say but that is what a proper CI process is for and testing but what if that typo is in the CI process or tests?)
If you sell cutlery without a handle and expect your end users to simply wrap it in a towel before using it maybe you should share some of the blame when your users hurt themselves.
This looks more like a mess that would happen if S3 buckets by default were accessible to anyone with an Amazon account. Which would clearly be a colossal mistake made by the platform.