You can enable public file ACL access restriction at the account level and issue authenticated/signed links for file access if required for general consumption. The idea that your data layer shouldn't be open to unauthenticated read from the public shouldn't be new to people but persists with somewhat "easy" buttons to enable behaviors.

For static sites or other public access required files setting up cloudfront with an authenticated origin pull is pretty straightforward and in our case we use a terraform module to provision and secure the bucket/distribution. I think this come when you get dev/biz users with console access who are trying to "just get it done" when you are dealing with highly confidential or sensitive data, it's a recipe for leak.