I am not sure if it is actually true for TS. From what I understand the nodes advertise themselves in a different mechanism than what provides access. ACLs are set globally and the nodes fetch them.

So even with 0 access ACLs for node-to-node communication, nodes can advertise themselves to the control plane and change their config as the ACLs are updated.