Malicious or erroneous actor can also drop your s3 buckets. Account change has stricter permissions.

The key problem is that data loss is really bad pr which cannot be reversed. Overcharge can be reversed. In a twisted way it might even strengthen the public image, I have seen that happen elsewhere.