I was expecting this to happen at some point. Any picture uploaded to the internet should be considered public by default IMHO.
Also, S3 buckets accidentally made public was the highlight of engineering fuckups in 2017-2018 majors incidents were the U.S Department of Defense(lol) and GoDaddy.
Someone literally keeps a list on Github of the many companies that have "accidentally" made S3 data public nagwww/s3-leaks
The problem with that particular AWS service is because it's a Swiss Army knife. it is essentially like Google Drive on steroids. which is both what's good and bad about it. For instance, you can host your blog, document or anything on there anything you want to be public. I keep my resumé on an S3 bucket and just share the link on my personal website for recruiters to see.