If this is a timing sidechannel, why is it considered s protocol vulnerability and not an implementation vulnerability? Could it be mitigated by using a time-constant implementation of the KDF?
Because the specification does not mandate a constant time operation.
You are not mandated a constant-time aes implementation either.
nobody cares about an AES constant time implementation, but any specification about MACs and signing algorithms will specifically mention that you need to have constant-time operations