Re: I wonder if....
The former. S3 buckets have no public access by default.
The trouble is that the people who set these up cannot be arsed to spend the time correctly allowing secure connections to them, and instead just turn off all the default security.