> S3 buckets should be private and encrypted by default and devs should need to actively choose to switch those things off

Yeah, that's the case right now. There's multiple screens you have to go to, that almost scream at you that you're making EVERYTHING PUBLIC. Also, in the overview, it distinctly says "!! PUBLIC".