> How the hell these incidents happen?

Because race to the bottom.

People want incredibly cheap products that are internet connected. Your average home user should not have to worry (and won't) about cybersecurity concerns, so this will continue to happen. The only out I can foresee is government regulation stepping in to make these incidents actually hurt for the companies, but America has basically no appetite for that.

An individual S3 bucket or policy for each user?

Everything user specific. Nothing should operate across users. Why should it anyway. You only need to aggregate logs across users, cloud watch does this.

Well for one there is a hard limit of 1000 s3 buckets per account