I just learned this same thing (Object ACLs) last night, and my mind was blown that a bucket can have objects owned and controlled by other accounts, which then prevents a third account from accessing those objects even though it has bucket access.

But when you stop and think about it, it's a similar model as Unix file/directory ACLs...I just hadn't expected it to apply to S3 buckets too.

I still have the tab open for the docs to fix access:

https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walk...