This solution is typescript based (my python is rusty). Hopefully this gives you an idea of what is needed to get want you want. Essentially two steps: 1. unwrap the tags from the route table 2. filter based on needed tags

function GetPrivateVpcs(rts: aws.ec2.RouteTable[]): pulumi.Output<aws.ec2.RouteTable | undefined>[] {
    const privateRts: pulumi.Output<aws.ec2.RouteTable | undefined>[] = [];

    for (const rt of rts) {
        const localRt = rt.tags.apply(tag => {

            if (tag!["SubnetType"] == "Private") {
                console.log("Private");
                console.log(`length: ${privateRts.length}`);
                return rt;
            }

            return undefined;
        });

        privateRts.push(localRt);
    }

    return privateRts;
}

const vpc = new awsx.ec2.Vpc("vpc", {
    cidrBlock: "10.100.0.0/16"
});

export const privateRts = vpc.routeTables.apply(GetPrivateVpcs);

This is the working function. Replace GetPrivateVpcs above with the below

function GetPrivateVpcs(
  rts: aws.ec2.RouteTable[]
): pulumi.Output<aws.ec2.RouteTable[]> {
  // Resolve all outputs first, then filter within the apply.
  return pulumi
    .all(
      rts.map((rt) =>
        rt.tags.apply((tags) => ({
          rt,
          tags,
        }))
      )
    )
    .apply((unwrapped) => {
      const privateRts: aws.ec2.RouteTable[] = [];

      for (const rt of unwrapped) {
        if (rt.tags!["SubnetType"] == "Private") {
          console.log("Private");
          console.log(`length: ${privateRts.length}`);
          privateRts.push(rt.rt);
        }
      }

      return privateRts;
    });
}