My understanding is:
Given that Alice has a repo repo (alice/repo) and Bob forked repo from Alice (bob/repo).
Now Bob makes a pull request into Alice's repo.
If you used on: pull_request, then the workflow runs the code defined by bob/repo but also having access to alice/repo.
In other word, Bob used Alice's resources to run his workflow code which is an absolute no-go as that means he could steal Alice's credentials with his own malicious workflow definitions.
But if you used on: pull_request_target, then the workflow runs on the code only existed on alice/repo and so Bob can't hack Alice, given Alice was competent enough to not let any malicious workflow code passed the code review.
However, if Bob is legit, this also added extra burden on him who really wanted to test his code with the official setup on Alice's workflow, say like getting a special dependency to build his artifacts from Alice's Maven/Nuget package repository of whom Bob doesn't have access to (so he can't test it locally), or Bob wants to have a dev Docker image released on Alice's repo instead, assuming some base image is only accessible from Alice and alice/repo. (again, this scenario may sound dumb and novel at first, but is practically very common on large projects with private dependencies)
So, most people just use a compromise, which is still use on: pull_request, but instead of letting you run right away, the contributors will need to do several code reviews and minimum amount of LGTMs first.