Earlier quoted context omitted.
Regular expressions can be as robust as you need them to be, just like any other kind of code. They are a DSL to create lexers, and they are exactly as robust (or hacky) as if you wrote the same lexer by hand.
C code can be as robust as you need it to be. So why bother with formal verification, safe C coding standards, Rust, etc? The answer is that it can be robust, but the effort required to do that is so large that in practice it usually isn't.
Because that sounds counter-intuitive to me. A regex is a higher level DSL for lexing.