AFAIK any app can opt out of VPN by binding to the wifi/cellphone interface directly, bypassing the OS's routing tables. You need to enable "block connections without VPN" to prevent any leaks.

No, Tailscale specifically excludes some Android apps and crucially prevents you from removing this exclusion: https://tailscale.com/docs/features/client/android-app-split...