I think the "duplicate content" issue is overblown. There's no such thing as a "duplicate content penalty" otherwise thousands of WordPress sites would get penalized right out of the box. Duplicate content is displayed on archive pages, index pages, search results, in addition to the main article page, by default.

I generally see this manifest itself in Google results when things like /page/12/ are ranked ahead of the main article. It's probably best to use a SEO plugin to clean that sort of stuff up. Canonical URLs (WordPress default) help too, but it's not a guarantee.

While this is a separate issue since we're talking about content on separate domains, the alleged Matt Cutts conversation about a list of "root domains" for sites like WP Engine is interesting, as I've never heard of anything like that before, but it makes sense.

Just because it's indexed, doesn't mean it ranks for any meaningful keywords. I see a lot of WP Engine-hosted sites in search results, and don't think I've ever seen the .wpengine.com version rank at all. So I tend to believe this something is going on to prevent this, whether it be the "root domain" thing or some other algorithmic check to make sure main sites rank and staging sites don't.

On the privacy issues, yeah, it's definitely a little too easy to grab all those *.wpengine.com staging URLs with a simple Google query. There's no reason for those to be indexed at all, as support can always access the subdomain directly.

But it's also worth noting you can do reverse IP checks and find out the URLs hosted on ANY server pretty easily as well. Is it really WP Engine's fault that some unlaunched Harvard website exposed itself to the entire internet? That's the developer's responsibility to keep things under wraps, not the host.

I'm not even going to comment on how the whole #FailboatGate situation played out on Twitter and blog comments elsewhere, but both sides could've probably handled things a bit better.