That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment.
I suspect Tailscale's customers have found the same.
This is one of the major things I _don't_ like about Tailscale. I wish they'd just stick to enabling Wireguard and making the authentication easier (i.e., where they started). I'm not a fan of most of the features they've added since. I don't want service discovery, magic DNS, SSH key management and/or the kitchen sink bolted on.
Linux DNS is a clusterfun: https://tailscale.com/blog/sisyphean-dns-client-linux/
But, yeah, without systemd-resolved Linux DNS is a fight for the death between uncooperating processes. NetworkManager is okay but there are a dozen buggy variants in the wild we have to work around.
Linux is by far the worst platform for DNS config.
I totally recommend systemd-resolved. It's the only thing that does DNS well on Linux.
The firewall is the system. Just like apple bypass its own firewall and just send packet back home. Or the chinese way.
Of course as said by one of the author the key is to control port 22 or rule for ssh. That is not a totally lost. Still, one that is ok … you are breaking the system by promoting a way to bypass it. Or just 1 rule. It is so hard to remember.