I could also see this being a bucket that was explicitly configured to be open. Perhaps because that’s what it was in dev/test for ease of work, and the CodeFormation/Terraform/CLI script/whatever deployed the bucket to prod, was just cargo-culted right from dev/test with no review. Happens a lot these days.