The approach still 'works' (in some sense) because the user can only supply the regex in the form of a string which is later compiled into and/or included into the compilation of a real regex object. Just don't use the metacharacter escaping mechanism of  \Q...\E or the quotemeta function.

However, there seems to be another problem here: you say users may write any valid Perl regex, but you have also said (or implied) that they are not required to know anything about regexes nor to suffer any danger of exposure to such knowledge. This seems like a prescription for a major headache, if not disaster. User-supplied patterns would usually be validated or meta-quoted up the wazoo.