Bearer tokens trust possession alone
A bearer token is valid simply because it's presented — the system verifying it has no way to check whether the party presenting it is the one it was originally issued to. This is convenient and is why bearer tokens are common, but it also means a token intercepted in transit, leaked in a log, or copied from a compromised client is fully usable by whoever now holds it, with no further check required.
Proof-of-possession changes what's being verified. Instead of accepting the token alone, the verifier requires the presenter to also demonstrate control of a specific private key or secret associated with that token — something a copy of the token's bytes alone doesn't include.
Binding narrows what a stolen token is worth
Token binding ties a token to the specific connection or key it was issued alongside, so that using it from a different context fails even if the token's contents are otherwise intact. This doesn't make interception impossible, but it changes what an attacker needs: not just the token, but also whatever it's bound to, which is generally much harder to exfiltrate together.
The tradeoff is complexity: proof-of-possession and binding require supporting infrastructure on both the issuing and verifying sides, and they don't help if the underlying key material is stored somewhere just as exposed as the token would have been.