I wasn't able to find any official reason. But generally, injection of a
base tag can be used in HTML injections.
For example, consider that an attacker can only post very limited HTML (but can use
base). Depending on the point of injection, they could now hijack existing forms to send the information (eg CSRF tokens, passwords, etc) to their server.
Of course, in this case setting
form-action would be better than setting
base-uri, but might not be practical (eg because legitimate users need to create arbitrary forms).
Another example would be a case where developers can't or don't want to restrict where scripts are loaded from. They have an XSS filter in place which prevents script injection, but they forgot to filter
base. An attacker could now perform XSS via
base HTML injection. Setting a
base-uri would prevent this.
The examples might seem a bit far-fetched. But I would assume that it is these sorts of corner cases that the directives are meant to protect. The
base tag has little practical use (at least in production), so why not provide the option to limit it?
The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).
How does this work with base-uri? You would define base-uri to be your website's domain (i.e. example.com), this would limit includes to only be within the base-uri's domain.
As an example someone uses an XSS to do a remote include that loads an iframe (attacker.com/iframe.html) to steal users credentials. Since that is outside of base-uri that iframe will not load.
Hope that helps.