I know that web security is a hard problem but I can't wrap my head around the fact that static content has the same issue as a Wordpress blog.

That’s correct.

Only skip-a-heartbeat moment was when aws sent me an email saying that you I have “one or more S3 buckets that allow read or write access from any user on the Internet”

But none of my containers had write access. All of them had public read, but yeah, it’s a website and they know this: their own route53 DNS points to the containers.

They just sent the same generic mass email to everyone with any public container.

If you don’t have some form of automated throttling, couldn’t that still become costly if a popular webpage started pulling resources from that bucket?

If so, their warning could have been phrased better, but isn’t incorrect.

You can put the bucket behind Cloudfront and only give access to the bucket to Cloudfront.

But then, would the OP get an email saying they have “one or more S3 buckets that allow read or write access from any user on the Internet”?

The engineering team (that they fired) would have needed to explain that difference in so many details to stakeholders who just wanted to move on.

I'm sure there's liability, copyright, and trademark concerns as well.

If they would want to monetise their content in the future, they must keep it private before it's gobbled up by search engines and AI and becomes public domain.

Search engines have already gobbled it up the moment it was published. And it is probably in the training dataset of many AIs.

hmm, yeah all sites in the future that find themselves unprofitable take content offline to maintain license to AI potential.