It's only a real issue if it is in runtime code that parses untrusted input. 99% of the regex lints/CVEs that get flagged our way are in build-time code.

I don't fully get you. Do you mean untrusted regex or untrusted data it operates on?

And to be honest, even if the regex is trusted (came from a developer) and the data as well (something predictable and structured) we are still not protected from the developer using extremely stupid regex and breaking everything