That’s cracked it… so instead of adding in the proxies after the creation I created them in the initial configuration for the instance create and that’s solved the problem…
I am guessing that the LXD RESTAPI is fine with the lxd-client programs but has some edge conditions with direct access in this case via pylxd.
I’ll see when I can get time I’ll create a pylxd script that demonstrates this issue and raise an issue…
Additionally veth devices are no longer orphaned with that fix.
Interesting, a reproducer would be great if possible.
OK I’ve created a new GitHub lxc/lxd issue and have attached a test script…
the mkdud script uses python3 and requires the pylxd module the rest of the modules are pretty stock. The script is as simple as I could make it within the time constraints I have 
Run it the first time to create a dud instance and then try and exec or delete the instance. You’ll need force and once the instance is gone it will leave a veth device orphaned…
Oh yes and if your running NetworkManager be prepared for it to adopt the veth and then add a default route which will break WAN routing…
Let me know if you need anything else…