Are there ways to mitigate (unintended) leaks?

I partly disagree here. When I create an Access Grant all permissions are set and all buckets are selected and duration is set forever everything preselected by default.

That is exactly the opposite from secure default settings.