Comment by hylaride

As others have pointed out, this is by design. If VPCs have access to AWS resources (such as S3, DynamoDB, etc), an otherwise locked down VPC can still have data leaks to those services, including to other AWS accounts.

It's a convenience VS security argument, though the documentation could be better (including via AWS recommended settings if it sees you using S3).