Just speculating, but that it's an option to open/listen to a port, but that port is on a Tailscale network. So the app is largely unaware of the encryption over the top. Similarly, you could do similar for a client app. Where the Tailscale connectivity options are inside the app, instead of a proxy to the app that lives outside the apps.

Likely more transparent than explicit/implicit TLS.