Hi!
Now this is a fascinating idea! I was thinking about binding purely in terms of scoping of names within one program, but you’re right that it has entirely different advantages too.
To this list of examples you can add WebAssembly — a bytecode which by default cannot interact with the outside world, but requires callers to explicitly import functions into it. (I saw this great article about it just the other day: missing the point of webassembly — wingolog .)