They don't even bind the port. Instead, their client gives special treatment to packets arriving on port 22 over the tunnel instead of giving them to the kernel

They don't even bind the port. Instead, their client gives special treatment to packets arriving on port 22 over the tunnel instead of giving them to the kernel over the tailscale0 interface.