1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.
I would say cryptographic integrity definitely counts as "security".
I agree this isn't currently a big deal, but it's probably time to start migrating to a better hash.