Validating every single service I run on my home server for security (currently at 30 containers + other non-containerised random crap) vs. enabling the built-in Wireguard server on my router (which is more or less as simple as setting up Tailscale). I have a very different idea on which of these is overkill.

What makes you think simply throwing random crap on a home VPN network is secure?

Tailscale/Wireguard is overkill because it is not needed where access controls work fine which is true for the majority of the popular self-hosted apps. And you now have to install a VPN client/cert on every device you want to access your services from. That's a major oof.