Hacker News Reader

Is this applicable to public & private buckets alike? Like if I keep making requests with the wrong token?

Yes. If a request is unauthorized, the bucket owner pays for the API operation anyway.