An example of this in EdgeLisp:
The macro FOO expands to code that defines a variable X using DEFVAR, and prints its value:
(defmacro foo () #'(progn (defvar x 1) (print x)))
(#' is EdgeLisp's code quotation operator.)
Using the macro has the expected effect:
But X isn't actually a global variable now:
; Condition: The variable x is unbound.
; 1: #[handler [use-value]]
; 2: #[handler [retry-repl-request]]
; 3: #[handler [abort]]
The name X only makes sense inside the expansion of (foo). Outside, it gets transparently renamed by the hygienic macro system.
(In EdgeLisp, a UUID is attached as color (or hygiene context) to the identifier.)
Why the secrecy of toplevel variables? Well, it's simply an extension of the notion that identifiers that introduce new variable bindings (such as those in a LET) need to be treated specially to prevent unhygienic name clashes between macro- and user-written code. This secrecy completely frees macro writers from having to care about the identifiers they choose.
(Discussion of this topic on the R7RS list: Are generated toplevel definitions secret?)