Binning/timecharting seems quite straightforward regarding time... unless you want to span day+ ranges.
From experience I might say that if you bin or timechart with span of a day or more, the value of _time gets snapped to midnight in user's timezone.
That's what experience shows.
But the question is (because I can't find any) is there an official Splunk documentation stating that this is the designed behaviour?
