but having to unprotect resources one by one isn't ideal, having to leave them unprotected isn't awesome either

Not currently - please do open a suggestion on this in github!

+1 for app.pulumi.com API to toggle protection