Originally, only root could do any mounting.
One reason for this is that arbitrary mounting allows you to mount something over /etc which contains a passwd (and shadow for systems which have it) with contents you control, so you can then log in as any user including root. This is why when user mounts were added they were restricted to specific, safe locations, either by specifying fixed posibilities in /etc/fstab or via tools which only mount in places reserved for them (e.g. pmount). In addition to the obvious problem with replacing /etc, in principle any directory might be security critical depending on what software is being used, so it's not sufficient to block access to a fixed list of dangerous places.
Another way to get root access if you can mount is to mount a filesystem which has a set-uid executable in it. This is why user mounts must always disable setuid for anything they mount. When a volume is mentioned in fstab setuid can be left enabled because the volume has been specifically permitted by the administrator so should be as safe as any other part of the filesystem.
And thirdly, if there is a volume which is normally mounted at a specific place (e.g. /home/alice/secretproject/bigdata) then it may contain data which is normally protected by the permission on a higher directory (in this case, presumably, /home/alice/secretproject). If you could mount it elsewhere, then you could gain access you shouldn't have (this could be mitigated by alice setting the permissions for all files in the root of the volume, but that is weak as it also requires remembering to do it when new files are added). When user mounts are permitted, this weakness is avoided in two different ways. For internal volumes, you can only mount them via fstab, so the administrator has deliberately made them available at fixed places. For external drives, the fact that you have physical posession of the device means you could put it in any machine you control, so by letting you mount it you are not being given any access you don't already have. This is why the default does not allow the same for internal drives. You might be accessing the system remotely with the volume inside the computer securely locked away in a room you don't have access to, so allowing you to mount the volume gives you access you wouldn't otherwise have.
I note that other answers mention malformed filesystem. This is clearly nonsense as external USB drives could just as easily be malformed and since they are under the control of the person inserting them could be used as an attack if malformed filesystems cause a problem. In contrast, an internal device could have been vetted by the administrator so potential malformation is not a reason to prohibit users mounting it.