Pico and ESP8266

it strikes me that it is not abiding by the passed timeout param since it seems to return directly?

Not sure I understand? The function will return immediately, but the callback gets called when a string is received or the timeout elapses.

With my attempts to use at.cmd I only get the first, and immediately?

You need to call ATE0 on initialisation - which turns off ESP8266's echo. It's easier for the code and obviously faster too - as it's not having to parse out what it sent. The ESP8266 module should do that automatically?