While that's true, they might have made it easier for customers if they decided not to deprecate bucket ACLs. They are even hypocritical there in the sense that their own product (Control Tower) uses bucket ACLs whereas they tell customers not to use them. ACLS were ultra-simple - mosltly READ, WRITE, FULL_CONTROL - very little margin for error.

Of course you still have complexity as you have the bucket owner, object owner and requester which might be 3 different entities, but still mentally easier to grasp than policies with dozens of options you need to read documentation for to understand what they are for and what the consequences of using them are.