My biggest concern is how many of those subdomains with fresh, ready to install copies of WordPress exist. I could potentially scrape based on those subdomains that are indexed, locate what I'm guessing would be hundreds to thousands of that same scenario, and go ballistic.

Something certainly needs to be changed here. A staging area is good, but exposing all of those is a serious potential security risk.