It looks like it's just for logging, why does it need to block?
Regex is going to be something like 10,000 times quicker than the quickest LLM call, multiply that by billions of prompts
Besides, they probably do a separate analysis on server side either way, so they can check a true positive to false positive ratio.