Ah, I see what you mean now. Yes, that's true; you'd still need a firewall for LAN.
> What does “at the network level” mean?..
I meant the normal non-Tailscale firewall (e.g. iptables).