Airtable has not stated why primary fields cannot be rich text. However, I doubt it is for security reasons.
I suspect it is engineering issues in trying to show the formatting in linked record fields. The primary field values are stored under the hood as plain text, and rich text fields loose their formatting when used in calculated fields.
This is a software engineering issue that was setup years ago. Obviously not all primary fields are plain text—number fields are stored as numbers, and dates are stored as dates. But plain text version of these values are used in other parts of the user interface. Changing this would require major re-engineering that probably isn’t a priority for Airtable right now.