I agree with you that many moats are regulatory, but disagree that most moats are. Networks are powerful moats, customer lockin can work well, brand is a strong moat (at least for a time), speed and culture can function as moats.
Fwiw, I don't think any moat is ultimately perfect. Moats themselves are not meant to permanently stop an attacker - they are delaying tactics at best. Companies that stay ahead continuously re-invent and rebuild their differentiation and defenses.