TIL that the directories that `snapd` binds are just hard-coded, right in the guts of the thing
https://github.com/canonical/snapd/blob/aad0536a921429dd7759f9654ea7503fc4f6a875/cmd/snap-confine/mount-support.c#L935-L950
The snapd and snap tools enable systems to work with .snap files. - canonical/snapd