Can anyone shed some light on why this is being seen as a change, when i see no actual change here

++aws:ec2/instance:Instance: (create-replacement)
        [id=i-091ffb5881d32ef46]
        [urn=urn:pulumi:dev::infra::aws:ec2/instance:Instance::dev]
        [provider=urn:pulumi:dev::infra::pulumi:providers:aws::default_6_27_0::3dd98521-1036-4cf1-a9eb-e2791095f13e]
      ~ securityGroups: [
          + [0]: "sg-0badf7fd2fba24cc6"
        ]
    +-aws:ec2/instance:Instance: (replace)
        [id=i-091ffb5881d32ef46]
        [urn=urn:pulumi:dev::infra::aws:ec2/instance:Instance::dev]
        [provider=urn:pulumi:dev::infra::pulumi:providers:aws::default_6_27_0::3dd98521-1036-4cf1-a9eb-e2791095f13e]
      ~ securityGroups: [
          + [0]: "sg-0badf7fd2fba24cc6"
        ]

It's triggering a change due to securityGroups but this has not changed.

I don't think so, this looks like an aws provider issue. Worth raising an issue on the repo for it, the engine will respect what a provider says is a "diff" even if the values look the same to the engine.

@echoing-dinner-19531 you mean on the upstream terraform provider repo for this resource? I've also seen similar artefacts raised in a diff relating to tags (https://pulumi-community.slack.com/archives/CDE799L1M/p1711522084191549)... wondering if this is a larger issue or always something on the terraform/provider? Would you recommend trying the aws-native modules where available if encountering these types of problems?

No I'd raise it at https://github.com/pulumi/pulumi-aws/issues. You can try aws-native, you can use it for just one resource no need to change the whole program.