a common idiom we see is:
  -P /var/empty
  -b /
  -k '/run,/run,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M'
  -b /run/dbus
  -b /run/foo

the -k /run usage is there only to get a writable directory in the read-only rootfs so that further -b mounts may be made under /run.  there is no need to keep /run writable after those bind mounts.

so we could add a flag like --bind-mount-base with the semantics:
- create a tmpfs mount with sane default perms (basically the -k option as written above)
- process all the mount requests
- remount the path read-only to prevent any further writes

so now people can do:
  -P /var/empty
  -b /
  --bind-mount-base /run
  -b /run/dbus
  -b /run/foo