Managed to answer my own question. Not including scriptSigs in the hash leads to a vulnerability where an attacker broadcasts a modified version of a block which contains too many sigops, causing a node to reject a valid block as invalid. I conclude that the transaction hash for the merkle root must include scriptSigs, however it should be okay to use a different mechanism to compute the transaction id.
When Bitcoin had the tx malleability problems people said it was Bitcoin feature and any problems were the exchange's faults for not writing their software correctly. I think most Bitcoin exchanges modified their software afterwards to prevent problems. Did all the alt coin exchanges modify their software to prevent any problems?