Comment by SchemaLoad

Tailscale is best used as an additional layer of security rather than your only layer. I host everything behind tailscale as if it was the public internet, with proper authentication, https, etc.

So a failure in tailscale is not an issue on it's own because you'd then also have to find an exploit in what I'm actually hosting as well. Both of those things happening at the same time is much less likely.