I remember at some point when I was still a newbie with S3 I originally had the permissions for my company's S3 bucket too open. Even though it was a public bucket, containing image assets which were intended to be distributed publicly over the internet, I was allowing the LIST operation to be made against the bucket. Amazon actually sent me an automated warning email that I should remove public LIST permissions from the bucket, because allowing LIST operations could result in high S3 usage charges if someone started crawling our S3 bucket.

Removing public LIST access not only prevents charges from accruing from LIST operations but also allows you to keep your S3 resources semi-private even in a public bucket, by using hard-to-guess private URL's. Going to the root of the bucket no longer shows the list of files, instead it just shows an Access Denied message.

I don't know if Amazon still sends out the automated message, but if they do then those 1,951 open buckets are from people who either ignored the warning or couldn't figure out how to follow Amazon's instructions on how to fix the vulnerability.