Should the orgs that have exposed private data in S3 to the public internet have been using AWS Config and AWS CloudTrail and properly scoped IAM roles and eaten their broccoli and flossed their teeth every night? Yes, they should have. But they did not.
These problems continue to happen, even as AWS adds even more warning boxes that say "Do you really want to open this bucket/object to the public internet? Type 'SHOOT ME' to continue..."
In the grand scheme of things, I imagine that those data exfiltrations from corporate and government customers is a larger net negative for S3 than the positive of the fact that I can wire up my JAM stack static site to an S3 bucket and pay $0.0001 per month to host it on the public internet (rather than paying $0.0002 per month for S3 + CloudFront or S3 + Lambda).
In any case, I'm not the AWS general manager of S3, so there's no need to worry about my comments on this website affecting anyone's use of S3 :)