No surprises.
Regular expression implementation is fun and many interesting things have been done in this area. We are partial to the work of Gonzalo Navarro (in terms of summary papers) and the Glushkov construction, which predates the Thompson NFA construction and IMO is better in a number of ways for fast implementation.
I quite enjoyed the Russ Cox posts, but they are a very partial and idiosyncratic picture of regular expression implementation. RE2 is one point in the automata-style regex implementation space; Hyperscan is another, and there a bunch of other distinct and interesting approaches (e.g. the work from the Parabix guys, various hardware and GPGPU implementations, etc).
The finite state automata can potentially be exponential in the size of the regular expression you feed it. (Its states are set of states in the NFA.) Subexpression matching is more complex to implement and can make that exponential superexponential. (You have to go from sets of states to ordered sets of states.)
And these catastrophic expressions get much easier when you add in lookaheads, look behinds, and so on.
Mainly, it means it's super awkward — arguably so awkward it's completely impractical, because the result ends up being unreadable and probably slow — to do negative matching, i.e. exclusion.