You haven't noticed that PHP 7.3 moved to PCRE2, huh?

Or are you talking about updating during a series? The bundled library is updated when it's safe to do ABI breaks: when new series are released. If any individual fixes are needed afterwards (eg, security patches) then they're cherry-picked.

i have, but how does that change anything for 7.2?

to be honest the fact that 7.3 is using pcre2 and the amount of bugfixes in distributions is what makes me worry when bundled stuff get that less updates

pcre2 10.33 Apr 16 2019 to Mon Sep 09

- Fix a crash in JIT match when a subject has a zero length and an invalid
  pointer (upstream bug #2440)
- Readd a fix for a mismatch with a lookbehind within a lookahead within
  a lookbehind and fix the regression in matching a lookbehind after
  a condition (bug #1743863)
- Revert a fix for a mismatch with a lookbehind within a lookahead within
  a lookbehind (bug #1743863)
- Fix reporting rightmost consulted characters
- Fix an incorrect computation of a group length when a branch exceeds 65535
  (upstream bug #2428)
- Fix a recursion in compiling an expression with a lookbehind within a
  lookahead (upstream bug #2412)
- Fix a mismatch with a lookbehind within a lookahead within a lookbehind
  (upstream bug #2412)
- Fix an integer overflow when checking a lookbehind length
- Fix a DFA to recognize a partial match if the end of a subject is encountered
  in a lookahead, an atomic group, or a recursion
- Do not ignore {1} quantifier when it is applied to a non-possessive group
  with more alternatives
- Fix a non-JIT match to return (*MARK) names from a successful conditional
  assertion
- Fix pcre2grep --only-matching output when number of capturing groups exceeds
  32 (upstream bug #2407)
- Fix a crash when \X is used without UTF mode in a JIT (upstream bug #2399)
- Validate number of capturing parentheses

If you're concerned that the bundled version isn't always totally up to date then use your own version that is.
https://www.php.net/manual/en/pcre.installation.php