The 140 character limit isn't just an arbitrary number to see how creative people can be within it. Many people forget or never knew that twitter started out with its 140 character limit because of SMS limitations. SMS limits messages to 160 characters, and twitter reserves 20 of those. The final result of your message, including URLs has to fit within 140 characters to reach any SMS bound audience in a single message.

(1) Keeping it simple and consistent and (2) they want to ensure that as much relevant traffic goes through t.co as possible. If you want to lock people into t.co URLs, there's no reason for them to play games otherwise unless it truly starts eating into the character count. It's an avenue for profit through data mining. Also, the notion of blocking phishing sites is also there, but the real reason is data mining. They want as much desired, relevant data as possible about the URLs people are using on their service — where they're going, when they're going there, who's going there, etc., etc., etc. In the data, there is money. It's also about other untaped potential in being the middle man (e.g., injected ads) — not that they'll necessarily do such a thing, but from their perspective it's good to be in the position to exploit as many avenues of profit as possible.