“So what would happen if an attacker created securityrunners-packages-us-west-2 and an engineer decided to start exploring deploying resources in that region. Well now an attacker can arbitrarily execute code on your systems.”
S3 has one global namespace, so anyone can claim the bucket your Terraform will look for in a region you haven’t used yet. AWS’s own service buckets ship agents and installers like amazon-ssm-{REGION}, and a week of hunting found AWS had already squatted every region. AWS protected itself. Your templates still pull code from whoever registers the name first.