Their article on how NAT traversal works is an epic piece of work in its own right too:

https://tailscale.com/blog/how-nat-traversal-works

I do not think the Tailscale software implements everything described in that article. For example, the article says

> Now speak STUN through the NAT64 to discover your public ip:port on the NAT64, and you’re back to the classic NAT traversal problem — albeit with a bit more work.

I don't think the Tailscale software does this step. You can find several GitHub issues about this, such as https://github.com/tailscale/tailscale/issues/11438 or https://github.com/tailscale/tailscale/issues/11437