If you give someone a presigned URL, what's to stop them from downloading the object in a loop and running up your data bill? There's a "requester pays" feature, but that only works if they have their own account.
When you use the S3 Presigned URL feature, you have control over the time when the URL is valid.
PutObjectPresignRequest presignRequest = PutObjectPresignRequest.builder()
**.signatureDuration(Duration.ofMinutes(10))**
.putObjectRequest(objectRequest)
.build();
So you do not leave it open for very long if you have such concerns.