This is the case now. But was not the case 2-3+ years ago when most of the original infrastructure was probably set up. AWS S3 has made it significantly easier

This is the case now. But was not the case 2-3+ years ago when most of the original infrastructure was probably set up. AWS S3 has made it significantly easier to restrict bucket access, but those are all (relatively) new changes.