This is absolutely true! Probably everything you could do with WireGuard you could accomplish with OpenSSL/OpenVPN, but the complexity is staggering. This makes it much more difficult to troubleshoot and far more likely that there will be an error in the configuration that could lead to compromise.
Getting it set up was really easy. I think it took about an hour, which included standing up a new OpenBSD VM to run the server. Configuring clients (iOS) was pretty straight-forward and reasonable. I don't have a feeling that there's some security hole lurking in the configuration simply because there's not a lot to get wrong.
In comparison, IKEv2/IPSec was incredibly painful, especially when you also create configuration profiles for iOS and have to issue and distribute certificates. Once I understood how it worked it made some sense, but there's always that nagging feeling that I've screwed up the configuration because there's just so many options to get wrong. I've probably spent six hours, not all at once of course, getting it working and set up "just so."
In spite of all of this, I'm continuing to use my IKEv2/IPSec setup. I have not figured out how to get WireGuard to do split DNS, whereas this was a fairly simple part of the IKEv2/IPSec setup. The other requirement I have is split tunnels, but I think WireGuard can do that fairly easily.
Apart from being a 3rd-party service, which isn't really what I want, it seems to check all of the boxes. The documentation is very thin on the iOS side, but it seems likely that the iOS app can do everything that can be configured in the admin console. That configuration does seem to meet my requirements.
Is there a self-hosted Tailscale-like option?
The only other thing is automatic connection. In my IKEv2/IPSec setup, I've build configuration profiles for the iOS devices so that they'll establish a connection on-demand (triggered by a DNS lookup for my internal domain), but only when they're not on my home Wifi network. It's perfectly seamless since it's all built-in to iOS. The Wireguard app seems to deal with the "connect when not on home Wifi" part, but doesn't do the on-demand side. Wireguard is light enough that this may not actually matter though.
OpenVPN was always a nightmare