As @ayush-1506 has pointed out to me, the explanation for the behaviour is in BSON/src/extenstions.jl, line 20:
resolve(fs) = reduce((m, f) -> getfield(m, Symbol(f)), fs; init = Main
I think this means that the expressions parsed by the deserialiser are always resolved in the Main namespace, rather than in the namespace of the module calling BSON.load.
This seems like an unnecessary restriction.