(1) Keeping it simple and consistent and (2) they want to ensure that as much relevant traffic goes through t.co as possible. If you want to lock people into t.co URLs, there's no reason for them to play games otherwise unless it truly starts eating into the character count. It's an avenue for profit through data mining. Also, the notion of blocking phishing sites is also there, but the real reason is data mining. They want as much desired, relevant data as possible about the URLs people are using on their service — where they're going, when they're going there, who's going there, etc., etc., etc. In the data, there is money. It's also about other untaped potential in being the middle man (e.g., injected ads) — not that they'll necessarily do such a thing, but from their perspective it's good to be in the position to exploit as many avenues of profit as possible.