False dichotomy much!

See this postmortem from Cloudflare as an example.

Under "What went wrong", point 1 and 3:

1. An engineer wrote a regular expression that could easily backtrack enormously.

3. The regular expression engine being used didn’t have complexity guarantees.

And on what needed to done, point 4

4. Switching to either the re2 or Rust regex engine which both have run-time guarantees.

See! Plenty of procedural talk in that postmortem. Plenty of corporate talk too. But you have to mention that a bad backtracking regex was used. And you have to mention that using regexes with no complexity guarantees was glaringly wrong. To not have done so would have been silly. To not even come close to mentioning those things beyond the specific error in that specific regex, and you wouldn't have been taken seriously.