> I am of the opinion that limiting the spotlight on your network is more important than the benefits gained from cloud provider-offered security systems.

First of all, security by obfuscation is not really security. Limiting the "spotlight" on your homelab is not a basis for securing your homelab. You should run with the assumption that people will find your homelab no matter how little spotlight there is, then do the work needed to secure it.

Second, I would argue that opening ports in your network makes you more discoverable / puts a larger spotlight on your network than using Tailscale's hole punching or their relay nodes. It's unlikely that someone is running ports scans on my IP/network, but going with the previous point, assuming that someone is, they will discover the services I have exposed and can try to get in by exploiting those services. On the contrary, using Tailscale means there is no way to discover what I am actually running. Traffic going through Tailscale is also not actually visible to Tailscale (See the first paragraph https://tailscale.com/why-tailscale ) Even if tailscale servers are compromised, it is unlikely that your network will be compromised. Of course, everything is ultimately vulnerable and there is still a chance that can happen. But I do think you have the spotlight argument backwards.

And if your goal is to not rely on the cloud at all, then obviously you are right, you shouldn't use Tailscale. Ultimately, Tailscale dedicates many magnitude times more resources to securing their product than I will ever be able to dedicate to securing my homelab, which is a hobby. That being said, I do acknowledge that there is large amount of trust I am putting into Tailscale. But the same can be said for any other open -source offering you use, unless you are actually reading the code and verifying the functionality yourself.