Takes a good long time for cloudfront distro's to finish updating, but pulumi up wants to wait for it. Is that the expected behavior?

Yes because if it fails then Pulumi won’t know it failed on the next run

Makes sense. Distro updates can be like 20 minutes which is the hairy edge of timeouts right?

You can set custom timeouts if you like. https://www.pulumi.com/docs/intro/concepts/programming-model/#customtimeouts