Web forms don't seem to treat field lengths the same way the field app does. The field will turn red, indicating an invalid input, but it's the user's responsibility to trim back the text entered. The survey still can't be submitted with extra characters in that question.
I did notice a related issue with field length: If your survey was originally published with a longer field length (255 by default if none set), then republishing with a shorter field length in that same question won't change what you can submit. You can still submit up to 255 (or whatever the original length was).
The regex formula will still help with that, as it will only accept a phone number in the format of XXX-XXX-XXXX, no more, no less. But again, nothing is going to physically stop the user from entering an invalid format or length until they try to submit.
That said, your form does need a couple changes if you're going to use that regex formula. The required field length is 12 characters, not 10 (the dashes are counted), and the input mask--while not currently honored in the web form--will interfere with validating the regex formula as written if using the field app (XXX-XXX-XXXX vs (XXX) XXX-XXXX).