The way to think about it is that by using tailscale you’re not exposing your service to the outside: your service remains exposed only to your internal network and you get into your internal network through tailscale. However don’t take my word for it, definitely do your research and proceed with a solution that you’re comfortable enough with in terms of security. Nothing wrong with going slowly and verifying/understanding each of the steps along the way.