I was actually asked to implement a nightmare scenario everyone fears of IaC solutions like tf/pulumi: Destroy everything not managed. Is there a hook to destroy inverse-state?

An idea would be to add tags in your pulumi program and update. Then use resource editor in the console to find the resources without the tag.