> Can you help me understand that?

Like 10 nodes behind tailscale/wireguard in a private network, with only 2 nodes where you have a port open on 80/443, those are exposed to the public network. The rest of the nodes are all private like db, redis, etc etc.