> If you aren't comfortable with trusting them with control over your network
Wrt the possibility of Tailscale being compromised, there's the in-beta tailnet lock feature:
> Tailnet lock lets you verify that no node is added to your tailnet without being signed by trusted nodes in your tailnet. When tailnet lock is enabled, even if Tailscale infrastructure is malicious or hacked, attackers can't send or receive traffic in your tailnet. [1]