Of course, Tim’s concerns are fair.
That is perfectly correct, so I would 100% agree not to simply use an untrusted, user provided input as a regex-pattern. However, when it is about the data, I would say that regexes are commonly used as a tool to validate untrusted, user provided data. That is ok if the regex-pattern is carefully crafted (as Tim has pointed out in his response to the bug report). One key ingredient are possessive quantifiers as introduced in Python 3.11. However, getting it right seams still be so hard such that many people get it wrong.
All complexity issues related to backtracking can be fully avoided, if it was possible to easily deactivate backtracking entirely using a flag. As Tim pointed out here, backtracking is not actually required for many applications.
My concern is not to massively expand CPython’s regex engine, however it might make sense to provide and promote means that are safer than the status quo.