[fhke]

Notwithstanding the fact that this was a user misconfiguration, S3 allows you to configure public access blocks to prevent this sort of thing.

[endgame]

These days, you have to remove the public access block AND explicitly write a bucket policy (or set up deprecated ACLs) to allow public access.