Hacker News Reader

Do we know that this would be mitigated by https://tailscale.com/blog/tailnet-lock/? My instinct is yes...

Yes. Peers added in this fashion would not have been signed by a trusted tailnet-lock key, so clients would refuse to trust them.