It is laughable to hold those who make S3 buckets public accountable yet underplay the contribution of interface design. It's as if the NTSB had a report template with only a single checkbox for "pilot error".
Not so long ago this wasn't the case and various grey hat services would let you explore public buckets via a nice interface / API. What you could find was pretty shocking.
The idea of "don't use it if you don't know how" still applies though. In this world so many things can go wrong if you don't understand what button does what but that's not an excuse imho - AWS isn't designed for non technical people.
2) at a bank's scale it should not be using the console for anything in production.