Oh wow, I see the list of filtered commands. Bind is definitely on there with no workaround (other than some custom engine binaries).
If it helps you plug-in devs, here is the current list of banned
commands a server can tell a client to execute:
cl_filterstuffcmd (see below)
exec (not blocked in TFC)
The following commands are only banned if the client has CVAR cl_filterstuffcmd
set at non-zero
Anything starting with cl_, gl_, m_, r_, and hud_
Any command string containing ASCII characters lower than index 32, higher than index 127, or is a line feed
by default so those will pretty much always be banned too.
Might be better if we put in a command called bindslots
to fix players missing their number bindings rather than allowing the bind command to be issued remotely again.