It's about rate limiting, not access controls. Without implementing limits your spend can go above what your budget is. Without cloud you hit natural rate limits of the hardware you are using to host.

That might be the more general solution but in this context it is absolutely also an access control issue.

> It's about rate limiting, not access controls.

You just shouldn't be using S3 to serve files directly. You can run most public and many private uses through CloudFront. Which gives you additional protections and reduces things like per object fetch costs.

> you hit natural rate limits

Seen by your customers or the public as a "denial of service." Which may actually be fine for the people who truly do want to limit their spending to less than $100/month.

with "classic" hosting, your server goes down from being overloaded to the hoster shutting it off.

with AWS, you wake up to a 6 figures bill.