So a failure in tailscale is not an issue on it's own because you'd then also have to find an exploit in what I'm actually hosting as well. Both of those things happening at the same time is much less likely.
I don't see the reason for Tailscale instead of plain old simple Wireguard, it's WG under the hood anyway.
I am a relatively old school engineer. When building a bricks and mortar business recently I kept hearing about tailscale for remote access. Looked and saw it was just a wrapper over wireguard. I immediately went aha, there's a solid underlying project without the risk of something over the top trying to make life easier for people unwilling or unable to manage their own systems. Went with a direct wireguard on opnsense approach.
Bamn, proved right today.
Wireguard is perfectly elegant and maintainable as it is for me, and a wonderful improvement on traditional site to site VPNs.