“Insecure” means “unspecific” in this context. Both the dot . and the exclusive range [^…] are not clearly defining what should be matched by the regex. For validation purposes, this can propose the risk of successfully matching stuff that you did not think of and do not want (think: white-listing vs. black-listing).
In any case, dot and exclusive range are valid parts of a regular expression, and if they do what you need (like in this case), I would think of the warning as over-cautious.
A malicious user can fiddle with your page logic any time; the warning is more about the regular operation of the page.