The "layers" argument applies equally to WireGuard without Tailscale. Attacker still needs VPN exploit + vulnerable service. The difference: Tailscale adds att

The "layers" argument applies equally to WireGuard without Tailscale. Attacker still needs VPN exploit + vulnerable service. The difference: Tailscale adds attack vectors that do not exist with self-hosted WireGuard: account compromise, coordination plane, client supply chain, other devices on your tailnet. Those are not layers to bypass, they are additional entry points. Regardless, it is still for convenience, not security.