Because the internet generally does not route RFC1918 addresses, and in particular not to you. But that is not a security feature, as there is no guarantee that

Because the internet generally does not route RFC1918 addresses, and in particular not to you. But that is not a security feature, as there is no guarantee that noone will ever send such packets to you, it's simply that those addresses are not (uniquely) allocated to you, and therefore, your ISP doesn't know to route them to you. Also, many ISPs won't accept routes for RFC1918 addresses from other ISPs because it is well-known that they are not allocated to any particular party, and anyone announcing them risks being flooded with packets leaking from local networks that cannot usefully be delivered anyhow. But nothing prevents your ISP from sending you packets addressed to RFC1918 addresses. Or anyone who happens to have compromised your ISP('s router), for that matter. Also, it happens that ISPs fail to properly isolate customers, and neighbours who are customers of the same ISP can directly send layer 2 packets to your router. Or it happens that ISPs forget to disable routing protocols on customer-facing ports, and if your router is misconfigured as well, it might be announcing your RFC1918 prefix to your ISP, which then would start routing packets from its other customers addressed to that prefix to you (probably not from other ISPs, as BGP peers usually would drop such routes--but even that is not guaranteed). It's just a convention to not route RFC1918 addresses over the public internet for the simple reason that they are well-known to not belong to anyone in particular, and in any case your ISP generally wouldn't know who of the many users of those addresses to deliver packets to. I guess that's a bit analogous to writing "to Joe by the big tree" on an envelope and dropping it in the mailbox. That is not a clear, unambiguous address, belonging to one particular person, so chances are the postal service won't know what to do with it and it won't ever arrive. But that doesn't mean there is a guarantee that it won't arrive. Some postal worker might happen to know Joe and that he is known in some circles as Joe by the big tree, and the letter might arrive after all.