must admit that deploying to the /Bin is healthy since any dlls deployed to the GAC directory is granted "Full trust " permissions by default…so the /bin is more secure however it needs more configurations and settings to make sure your dlls are granted the right permissions to work

That required some special way to make the packages work still with the new structure and making it generate the Code Access Security (CAS) Automatically and add it by default to the web.config

so here is a small explanation of what we did

each project have AssemblyInfo.cs under properties folder example

you can set the needed permission for that assembly in that file example

[assembly: SharePointPermission(SecurityAction.RequestMinimum, ObjectModel = true, Unrestricted = true)]

[assembly: SecurityPermission(SecurityAction.RequestMinimum, Execution = true, Unrestricted = true)]

[assembly: WebPartPermission(SecurityAction.RequestMinimum, Connections = true)]

[assembly: FileIOPermission(SecurityAction.RequestMinimum, Unrestricted = true)]

[assembly: EnvironmentPermission(SecurityAction.RequestMinimum, Unrestricted = true)]

[assembly: AspNetHostingPermission(SecurityAction.RequestMinimum, Level = AspNetHostingPermissionLevel.High)]

[assembly: WebPermission(SecurityAction.RequestMinimum, Unrestricted = true)]

[assembly: AllowPartiallyTrustedCallers()]

I use the post build event to copy the generated dlls to the 80/bin folder located in the project structure

and build the WSP package using the WSPBuilder Also from the build events

Which automatically define the dlls located in the 80/bin folder and generate the CAS permissions and add them to the web.config when deployed and it uses the ASsemblyInfo.cs as reference for that

but i know for fact that there is no way we can deploy list event receiver to the bin it have to be deployed to the gac . that is even how it is defined in the SP API

also please consider that any feature scoped to web application its receiver should be deployed to the GAC , or else the package should also be deployed to the central administration site

since the web application features are activated form the central administration site .. it will look into the gac or the bin folder of the CA site for the feature receiver

hope that was clear enough