They are now, but IIRC that was not previously the case.
S3 Buckets have _always_ been private by default.
Yeah, AWS lets you do things--especially related to billing--that can really burn you if you make a mistake or don't know what you're doing. But making S3 buckets public is something they've really put guardrails on over time.
I’ve always found the main issue is not how easily you can make a bucket public, it’s knowing how to utilize a private bucket to serve assets or media in the first place.