> Simply give them a one-off URL that they type into their gameclient and they connect to it exactly like a public server, which I can then disable after the session.
What's the difference between this and a script that SSH's to your firewall and toggles a port's open-ness or alternatively a script that sends the required POST requests to authenticate and toggle your firewall (easily pulled out of the network dev tools in your browser as curl's)?
There's a hole in your firewall either way. What difference does it make if that hole that opens to your network is in tail-scales servers (with a public IP and port) or yours?
> I feel like this is a glaring product void that inexplicably nobody seems to have noticed?
I don't think this is a product void at all. The security cost of port forwarding to port in the non ephemeral range with no listening service is quite low.