While true, and a very sensible default, this misses one crucial point.

Setting granular permissions for an S3 bucket is hideously difficult. Want to limit access to a whitelisted set of users or origins? Write a bucket policy. This is where the UI completely fails.

0: The policies can become awfully difficult to understand even for straightforward use cases.

1: You can have policies with sensible rule sets, but the S3 UI doesn't allow to pick-and-attach any of them.

2: The "permissions" tab has a very convenient and extremely dangerous option as the top item: "allow access for any logged in user"

I'll let the last one sink in. It's not "any logged in user in MY organisation", it's really "ANY logged in AWS user". Putting the bucket essentially world-readable by accident is far too easy.