Does this mean I can expose home assistant online without worrying too much about security?
You probably don't want that, though, so vanilla Tailscale would let only you securely access your home assistant server from anywhere, as long as you install the Tailscale VPN app.
You can anyways access Jome Assistant over tailscale without all this.
I think there is even a Tailscale addon for HA.