can some resources be Delete Before Replace by default? I just found Azure's Role Assignment (specifically the native variant), which looks like it might explode unconditionally when Pulumi replaces it

You could try registering a stack transformation, the only case I'm not sure about it would cover is if you're changing the logical name of the assignment resource. Maybe

replace_on_changes=["*"]

in addition to

delete_before_replace

could do the trick...