I thought tailscale could not see your traffic -- that they essentially functioned as a known "reachable" address that keeps track of the current addresses for your devices, and when you connect they help point your devices at each other, which then blindly fire UDP at each other, which opens up your firewall for incoming replies, allowing your devices to connect directly.

So in short, I thought they basically just helped your devices find each other (and connect to each other directly), not currying any of your traffic. Which is how they can give people so many free devices (100 currently) -- because it doesn't really cost them any work / network load.

Also your devices connect directly over your LAN if possible, which goes against traffic flowing through them.

Please let me know if my mental model is wrong here, I'm certainly no network engineer.