Making a stolen credential worth less
Device binding ties a credential or an active session to a specific device, using something about that device that's difficult to reproduce elsewhere, so the credential functions correctly only on the device it was originally issued to. A credential that isn't bound this way works identically no matter where it's presented from, which means simply copying its value is enough for an attacker to use it fully, from anywhere; a bound credential fails, or triggers additional scrutiny, the moment it's presented from an unrecognized device.
This substantially narrows what a stolen credential is actually worth: intercepting or copying its value alone isn't sufficient if using it also requires reproducing whatever device-specific property it was bound to — the theft succeeded, but the usable outcome the attacker was actually after didn't necessarily follow.
Where the extra friction is worth accepting
Binding adds real friction: a legitimate user switching to a new device has to go through some re-provisioning step, rather than a credential simply working anywhere it's presented. This tradeoff is common specifically in contexts — banking applications prominent among them — where the cost of a stolen credential being fully usable from anywhere is judged too high to accept, and the added friction for legitimate device changes is worth paying to substantially reduce what a theft alone can actually accomplish.