The following shouldn't fail this rule:

<button aria-controls="my-modal">Open the modal</button>

This is an example from the new ARIA required ID references exist ACT rule that axe got wrong. It seems we put some logic around not requiring aria-controls not to fail when aria-expanded="false" is used. That came from combobox, but I think that when aria-controls (and aria-owns) isn't required axe-core should report it as needs review when the ref is missing, not as fail.