Software shipped by the distro maintainers I find is often properly locked down with systemd features, but third party stuff is always hit and miss. Definitely agree Tailscale should be shipping with the bare minimum privileges required.