Have you tried using the tailscale interface IPs (100.x.x.x)? I've been able to use VNC over those addresses.
But this does give me hope that it can be done in the first place, I just have some setting goofed up somewhere. I will restart my tailscale stuff now that I know someone out there has done it.
Thanks!