Are KDFs such as PKDF2 and HKDF vulnerable to side-channel attacks such as static and dynamic power analysis including the hash type used internally?
Technically speaking, a side-channel attack by definition doesn't attack a KDF but a specific implementation of it. An example of an implementation would be the way macOS turns a user's password to a disk encryption key with PKDF2. A gZip application may execute the PKDF2 in a slightly different fashion.
The answer to your question is yes, because you can never know if a developer made a mistake, or something like that. If that isn't what you meant please clarify.