Comment by Pirate-of-SV

I think it's problematic that most security features (configurable by the user) are switched off by default and require some effort to set up. This is getting better though and for S3 buckets specifically a lot of additional features have showed up lately to "solve" this.