I think there's two separate security risks that need to be addressed here:
Images which are actually in the e-mail. As some have touched on, there is inherently a direct correlation between the amount of content you allow your e-mail client to load and the attack surface of your computer while loading that e-mail. If you allow your system to load attachments automatically, it's much more likely that you may come across a malicious file that will compromise your computer.
Hot-links to remote content. This is most commonly what is being blocked when your e-mail client says something to the effect of "Click here to download pictures...". Once downloaded, these images may appear to be "in" the e-mail. But they are actually hosted on remote webservers. There's a few reasons you'd want to block these from automatically loading.
Obviously, your first concern is that the e-mail is a scam and the remote content is from a hostile source. Then, we're back to similar risks as with images which are actually in the e-mail.
As others have mentioned, this is something of a privacy compromise. Once your system contacts the webserver to download the remote content, a few things can be revealed to the host of that content:
- Your e-mail address. (And, it can be inferred that the address is valid and that the mailbox is checked somewhat regularly.)
- Your IP address.
- Your e-mail client name and version.
It's also worth noting that the information available via knowledge of your IP address, and association of that with your e-mail address, could include:
- Your general geographical location.
- The name of your employer and/or your ISP.
Though some e-mail addresses inherently leak employer/ISP/location information, IP addresses can leak this information regardless of what is or isn't in your e-mail address.
All of the above bits of information could facilitate future exploitation of your system, or phishing attempts against you personally.
Another possibility to be aware of is that the remote webserver, while possibly being perfectly friendly on its face, could be compromised sometime between the e-mail being sent and you reading it. An attacker could then replace the remote content (which would otherwise be from a source you know and trust) with some of their own, which brings us again back to point number 1.
Malicious links to active remote content, as opposed to just static images, could do even more damage to your system. As @tylerl mentioned, an image tag may actually point to a malicious script or other content which could harm your computer or perform unwanted actions on your behalf. By restricting remote content from loading entirely, this is avoided.