This would only be the case if the exchange doesn’t opt in. If the exchange opts in, they should do it automatically for their users or follow the same method and wait for users to opt in.
What should happen is the same/similar thing as when a regular fork happens.
- Fork block set to X
- Exchange opts in some time before X
- Exchanges freeze trading a few blocks before the fork height and take a snapshot of user balances
- After some blocks past X, the exchange starts trading xem again, and a new market for catapult tokens would start in parallel to nis1 xem at the same time
After 3, either the users will be given the catapult tokens without any input needed from users or the exchanges will require users to claim them.
Even if the exchange does not opt in in time, they can do so later but will only be able to claim based on the balance of the exchanges account at block X.
Because the exchange would mimic what is happening at the network level, a sybil attack as described in previous posts wouldn’t be possible. Actually, even if they didn’t, it still wouldn’t be possible.