You're right. Quoted from
man.txt:
"All non-alphameric characters other than \, -, ^ (at the
start) and the terminating ] are non-special in character
classes, but it does no harm if they are escaped."
According to that, we'll still have to escape the \] char, but the others may appear unescaped: /([.\][(){}+*?])/g.
