The obvious answer to this question is "it depends".
Before you go on to consider whether a point is a CCP it is expected that the team will consider whether the hazard is controlled by a prerequisite. So if you have checks on your suppliers, maintenance checks, operator checks, training etc. (all prerequisites) then the hazard may be controlled.
The key stage in any HACCP is the analysis of the hazard and assessing the likelihood and severity of metal ending up in the final product. If the likelihood is very low then it is reasonable to suggest that the risk is controlled by GMP prerequisites. Remember HACCP is about eliminating or reducing the risk to an acceptable level.
If on the other hand the likelihood of metal is high or that it can't be controlled by GMP (e.g. nuts and bolts on machines that can't be inspected easily etc.) then it is more likely that you should consider it a CCP.
If metal detection is a CCP then what happens if your metal detector breaks down? Does production have to stop? If it is 'critical' then surely its absence means there is no control. The controls are all the things you do to reduce the likelihood of metals and the detector is verification that your controls are working or not.
What if a business doesn't have metal detection? Is there then no control of metal contamination? Then what about other contaminants? How is glass, wood, plastic etc. controlled? In a manufacturer of goods in glass bottles then x-ray is more likely to e critical due to the risk of glass splinters etc. This is due to the increased likelihood of glass contamination in this particular business.
Metal detection is useful as it gives confidence in your procedures and reduces the likelihood of metal contamination ending up in your product but the likelihood may already be at an acceptable level, so all you are doing is reducing it further.
The European Commission wrote some guidance of the application of HACCP including the flexibility provisions and assessment of risk which is well worth a read. HACCP provisions like most food law (in the EU anyway) was written to be flexible to suit any business and therefore is not prescriptive. So what is required depends on the nature of the business. Therefore the answer isn't as simple as always yes or no. It depends.