As later confirmed by AWS support, S3 charges customers for both legit and unauthorized incoming requests.

The developer tried to test this potential security and privacy nightmare by opening his bucket to public writes.

Amazon S3 bucket with placeholder-like name leads to $1,300 in charges