Let's say a NAT64 Router only has 1 IPv4 address for bindings, meaning
the NAT64 router has a roughly 65535 transport addresses.
That simply is not true. Transport addresses are per protocols (TCP port 12345 is not UDP port 12345), and a NAT table actually uses the source and destination IP and source and destination transport addresses. You have many, many times 65,535 address combinations for possible table entries for each protocol.
A malicious attacker can then exhaust the entire IPv4 transport
address space by performing 65535 request to network on the other side
That is untrue. It is unlikely that an attacker can exhaust all the possible address combinations. What you need to worry about are the table resources. The NAT device will have a limited amount of RAM for the NAT tables (one table for each of TCP, UDP, and ICMP). A device set up for NAT64 will have far more RAM for that than a normal router, but there is still a limit, and the table space can be exhausted, but the table entries will also have a timeout. This is far less of a problem than you may imagine.