Looks like they actually might have added locking recently with https://github.com/pulumi/pulumi/pull/2697 but I haven't looked deeply