Ah, I see what you mean now. Yes, that's true; you'd still need a firewall for LAN.

> What does “at the network level” mean?..

I meant the normal non-Tailscale firewall (e.g. iptables).