S3 buckets have never been public by default. They were, however, very easy to make public before things like Block Public Access existed, so lazy devs would just click that button rather than doing proper access control.