In that situation, a malicious actor can execute arbitrary code on an S3 box that likely hosts all kinds of government / business critical data. OP's point is t

In that situation, a malicious actor can execute arbitrary code on an S3 box that likely hosts all kinds of government / business critical data. OP's point is that unless your static website secretly contains nuclear launch codes, the actor will not spend his time coming after your site. You would hear about this kind of situation in the newspaper before your website would change.