We don't use Tailscale, but we do run a Wireguard server. It allows our remote workers that need local network access. For example we run an internal kubernetes

We don't use Tailscale, but we do run a Wireguard server. It allows our remote workers that need local network access. For example we run an internal kubernetes cluster that is not accessible over the internet. And we also have SMB shares that a remote worker might need to look into. Basically the use of a VPN is to add an extra layer of defense. Instead of finding a security hole in our Kubernetes management interface or samba server, an attacker would first have to compromise a workers system, and only then attack our internal servers.