the author warns to not forward to the internet. I guess there are homerouters out there isolating each client.

I agree that wireguard is the way. Besides tailscale, a bit of config autogeneration goes a long way there - easy-wg-quick and friends