When you setup an S3 bucket the permissions are pretty explicit. The issue here is the UI is confusing (arguably it's wrong but I digress) and is related to a configuration that you'd have to hunt for. It's not an obvious permission that you can easily know it should be changed unless you have experience with it (whereas S3 it's listed right there when you created it and by default it's pretty private).