Encryption and authorization solve different problems. Server-side encryption protects stored data, while policies and public-access settings control who can request it. An encrypted bucket can still have an unsafe public policy. S3 Block Public Access adds controls for public policies and ACLs; it doesn't replace a least-privilege design.
Website hosting changes how a bucket serves static content. An S3 website endpoint and an authenticated object request are different access paths, and an S3 website endpoint doesn't itself provide HTTPS. For limited private sharing, a presigned URL delegates a time-limited request using the signing identity's permissions. Treat the URL as a credential. Expiration, permissions, and object existence still matter, so a link isn't a permanent public-access plan.