[farfatched]

"Tailscale is a zero trust network!"

That's the problem. Tailscale is not zero trust. Tailscale can be used to implement a zero trust architecture, with if deployed with sufficiently granular ACLs, but the most common deployment is machine-oriented, rather than service or request oriented. In which case, any process on that machine has a lot of access.

Tailscale calling itself zero trust might be what leads users to think "use Tailscale, job done".

I think Tailscale know that, which is why they barely mention locking down access ACLs.