My point is that it is possible for your password manager to sandbox regex execution at least as well as your browser does. I totally agree with your concerns

My point is that it is possible for your password manager to sandbox regex execution at least as well as your browser does. I totally agree with your concerns about scope creep increasing the attack surface.