Why does bucket policy not apply to public object but does apply when requiring secure transport?

In section S3 ACL access policy, about 9 mins into it, even though there is explicit deny all, the public object can be accessed using the https url. The explanation was that because it does not go through the authentication mechanism. But in section Forcing Encryption using S3, a bucket policy was used to force the access only through https. Why does the bucket policy apply in one case but not another?