This is exactly the same thing - an obvious security oversight that resulted in private information being disclosed, simply by modifying the URL.

The fact that the results are so different is irrelevant - the attack vector was essentially the same.

Also, even with the complete lack of security on this site, it should still not be possible to take any action on the victim's AWS account. IAM has read-only roles for this exact reason - hopefully no-one was negligent enough to post their master AWS key/secret in to this or any other third-party site.