Why is SHA1 preimage-resistant? The best reference that I can find is Rogaway & Shrimpton's 2009 paper, and I'll use their definitions. The kind of preimage resistance that is wanted is aPre. There is a provisional (but strong enough, since the compression function goes from 512 to 160 bits) implication of aSec->aPre. But there is no implication from Coll->aSec (or from anything else ->aSec, for that matter), and most of the published work concentrates on Coll. So, perhaps I should ask: why is SHA1 second-preimage-resistant?
We know that the RSA public-key cryptosystem is based on the inherent difficulty of factoring large primes. Is there a similar intractable problem that lies behind second-preimage resistance?