Because object storage doesn't have an actual directory structure in the traditional sense bucket or directory permissions aren't inherited by objects. They are managed independently. So you can have a public object in a private bucket.