We don't minify CSS and JS by default because we wanted to make it as easy as possible to contribute. Requiring a compile step makes this more difficult.
Besides, gzip makes a much bigger difference in the file size. After that, minifying only saves a few bytes. Although for some reason it looks like the JS files aren't being gzipped on the Q2A site... I'll check into that.
Regarding 1.7.4, Gideon implemented the security fix immediately, but didn't upgrade the rest of the code (few minor fixes that aren't too vital).