The reasoning behind this is that in most cases, the unsecured content is only ad banners, and will not be of any concern. Thus IE allows insecure images on a otherwise secure page by default.
However, there is 2 cases where images still might be a concern:
- If the image is modified to be "protected by basic auth", then the browser might popup a authentication dialog, that can trick you into thinking the authentication dialog belongs to the HTTPS site. However, IE will warn, see this Picture, if BASIC+HTTP is mixed:
If the attacker uses digest, he will not be able to gain any password information. So never enter any username or password if the dialog carries the warning above, if you're on a HTTPS site. Only DIGEST+HTTP, BASIC+HTTPS or DIGEST+HTTPS will suppress the warning shown above.
But both these cases is very uncommon, so you can safely keep the setting off (allow load of insecure images on HTTPS pages)