I have not bought any ETH, but I bought ETC (a couple of days ago on bitfinex); however, I understand that recently, some folks had been buying ETH (I think on Coinbase), and they would receive both ETH and ETC, when they transferred their ETH to Poloniex (I don't have a Poloniex account) - so maybe i got ripped off on Bitfinex, if there were better deals?
No, of course not. If you buy ETH NOW, you only get ETH. This double thing only concerned people who had ETH balances on these exchanges at the time of the fork. THOSE were entitled to have an equal ETC amount (and only the amount they had at the time of the fork). Simply because anybody holding ETH on chain at the time of the fork ALSO would have had both after the fork. So in as much "holding a wallet on an exchange" is the same as "holding the coins on chain", the exchanges ought to do so. If they don't, like BTC-e, then they are keeping their customers' ETC for themselves.
You can see ETH before the split as shares in a company XYZ, which split in two companies at the split: XY and Z.
A share from before the split automatically becomes both a share of XY and a share of Z. So any bookmaker that was holding XYZ for you at that time, is holding both XY and Z for you after that time. If he only gives you XY, that means that he's off with the Z in his pocket.
But any share XY AFTER the split is only a share of XY.
I don't really want to buy any ETH, but does anyone know exactly when the cut would have been to receive both ETH and ETC - I thought that it would have been prior to the hardfork, but who knows?
Don't worry, it is only pre-fork ETH.
There are no "exploits", and funny people call a normal property of forked chains "a replay attack" but it is normal, and has no malice, but if you don't understand it, you can send your ETH when you only wanted to send ETC and vice versa. A valid pre-ETH address (not one with the DAO or the hacker, but all others) is valid on both the post-ETH and the ETC chain (simply because it is the same chain before split !). If you sign a transaction on such an address, of course, you sign it *on both chains*, so you move your pre-ETH *at the same time* in the post-ETH chain and the ETC chain. If you want to avoid that, you have to mix your transaction with coins post-split, so that the transaction is invalid on one of the chains (and you first have to hold some post-coin dust to be able to do so). With ethereum, moreover, Vitalik designed a special contract to have the same effect.
This effect will happen less and less, as more and more coins will get mixed with newly mined coins and will hence not be valid on the other chain.