You’d be surprised how bad security can be.

I agree with your sentiment, and no I’m not surprised, which is why I’m reading this as being “it was sitting on an unsecured S3 bucket but nobody was supposed to directly access it”.

Once you learn how much people are willing to pay for security the surprise sort of goes away.