Where to find the best wordpress thems / plugins

Typically I use Google and search for xxx plugin or xxx theme depending what I am looking for. Once I see whats available, I do another search adding "review" to the search string or visit forums like this one and ask for advice.

Here's a few great paid options:

WooThemes | Premium WordPress Themes (They have a few free ones too)
Gabfire Themes | Premium WordPress Themes
WordPress Themes, WordPress Templates, Joomla, Website Templates - TemplateSOLD.com
Premium WordPress Themes and Web Templates - ThemeForest

I'd be cautious on where you choose a free theme from as they may contain malware or a virus, which you definitely wouldn't want to pass off to your customers.

Here's a resource for free themes:

http://wordpress.org/extend/themes/

TemplateMonster.com
TemplateSold.com

Personally I would NEVER use google to find themes, if you do that you will just end up finding themes with hidden base64 code that will either hijack your theme after you activate it or just enable some spam links in the footer. - You have to make sure you go directly to a reputable website.

In fact most free themes now are created just for SEO purposes (as you have to use the anchor text in the footer for most of the best free themes to work)

there are some safe places to get decent themes from for free -

themehybrid, smashingmagazine.com and themelab.com are normally quite good.

If you want to go for premium themes and want bang for your book then Elegant themes are well priced and you get all of their themes for a stupidly low price, although themeforest is my favourite for individual themes at the moment.

It's normally safer searching for plugins with Google than it is for themes, the WordPress plugin repository, but be careful when picking plugins, most may say they are compatible with the latest version and while that is true, if you look at the required version, if it's an old version, like before version 2.6 or something it could potentially have some old code which would make your site vulnerable.