> Amazon S3 buckets that had previously been used across commercial and open source software products, governments, and infrastructure deployment/update pipelines—and then abandoned.

Couldn't this happen with a domain too? e.g. you stop paying and someone else takes it over but your app is still pinging it.

I don't see how AWS is really special here to be honest. If you can't guarantee you'll always have <thing that provides updates> then you should probably add in a signing mechanism to your software to verify it's coming from the original devs.