If I want to store say a popular ERC20 (e.g. BNB) in my new ERC20 contract, how do I prevent someone from making unauthorized withdrawal of these BNBs from my contract account ? Is it possible that a person can obtain the address of my contract, invoke an instance of BNB ERC20 contract and initiate a transfer of these BNBs to their account ?
Each token has exactly one token contract which acts as the token ledger. A token contract is typically for just keeping track of that one token - who owns and how many of said token.
A token contract typically cannot manage other tokens. In theory you can add such functionality into one but it would not be a very good idea. If you want to have some way to manage multiple different tokens you should create a new contract for handling them - or even just simply use a regular wallet.
However anyone can transfer any token to any token contract but after that the contract can't transfer the token onwards so the token is essentially burned.
So you shouldn't worry about multiple tokens in a single token contract because that just doesn't happen. And if it does the tokens are quite safe there as nobody can transfer them out of there anymore.