Gaah! And minutes after posting this I ran the same through strace(1) which made it progress even further, and exited with a slightly different message:
$ sudo sysctl kernel.yama.ptrace_scope=0
$ strace -tt -s1024 -f -o /tmp/foo flatpak update -vy com.jetbrains.IntelliJ-IDEA-Community
[...]
Updating…
F: Calling system helper: GetRevokefsFd
F: Calling system helper: GetRevokefsFd
fusermount3: mount failed: Operation not permitted
F: flatpak_dir_pull: Using commit d3f609b3c54fdcf1827636278e4d27b6be5e3f8a82302a106193c5c0f96688da for pull of ref app/com.jetbrains.IntelliJ-IDEA-Community/x86_64/stable from remote flathub
Updating… 0% 0 bytes/s
Updating… 0%
Updating… █▌ 8%
Updating… █▌ 8% 426.3 kB/s
Updating… ██▊ 14% 8.2 MB/s 00:30
Updating… ███▍ 17% 8.8 MB/s 00:29
Updating… ████ 20% 11.0 MB/s 00:24
Updating… ████ 20% 9.7 MB/s 00:28
Updating… ████▊ 24% 11.3 MB/s 00:22
Updating… █████ 25% 13.1 MB/s 00:21
Updating… █████▍ 27% 14.7 MB/s 00:18
Updating… █████▌ 28% 11.4 MB/s 00:23
Updating… ██████ 30% 11.4 MB/s 00:21
fusermount: failed to unmount /var/tmp/flatpak-cache-TDEZG2/com.jetbrains.IntelliJ-IDEA-Community-KJEZG2: Operation not permitted
Warning: Could not unmount revokefs-fuse filesystem at /var/tmp/flatpak-cache-TDEZG2/com.jetbrains.IntelliJ-IDEA-Community-KJEZG2: Child process exited with code 1
F: Calling system helper: CancelPull
F: Calling system helper: CancelPull
Error: While pulling app/com.jetbrains.IntelliJ-IDEA-Community/x86_64/stable from remote flathub: URI https://dl.flathub.org/repo/deltas/hv/KajdCfFMGZEUBkZ2WtWKpO5Gs1UFe_09u7x5XM+vA-0_YJs8VP3PGCdjYnjk0ntr5eP4qCMCoQYZPFwPlmiNo/4 exceeded maximum size of 2693773 bytes
Updates complete.
error: There were one or more errors
Aha! Downloading that delta worked just fine, so maybe something was wrong with the delta download?
$ flatpak update -vy --no-static-deltas com.jetbrains.IntelliJ-IDEA-Community
[...]
Updating… ███████████████████▏ 96% 29.1 MB/s 00:00
Updating… ███████████████████▊ 99% 25.9 MB/s 00:00
Updating… ████████████████████ 100% 25.9 MB/s 00:00
F: Calling system helper: Deploy
F: Calling system helper: RunTriggers
F: Calling system helper: PruneLocalRepo
Updates complete.
Did someone say Heisenbug? 