As far as I know, bucket names must be unique at other providers like AWS as well. [0]

I'm no expert but to try and protect my own domain, I use a transform rule to match a subdomain and append "/file/$MY_BUCKET_NAME" to each request. This should return a 404 for anybody who tries to inject their own bucket in the path. I could be wrong of course.

[0]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket...