How can someone derive publisher's intent from the content alone? If data is left on a publicly accessible URL, how do I know it's because a dev forgot to enabl

How can someone derive publisher's intent from the content alone? If data is left on a publicly accessible URL, how do I know it's because a dev forgot to enable s3 bucket encryption?