Oh, I wasn't aware of that. That's certainly worrisome considering Tailscale's default configuration for the ACL and authenticating new machines. Fortunately I updated my settings to change the default ACL policy and to manually approve any new machines.