A security researcher colleague of mine was/is exploring an unauthenticated avenue along this line. I don’t have any update, she told me she didn’t feel comfortable exposing information to anyone other than Tailscale staff until she’s confident in what she found or didn’t.

we'd love to hear about it at security@tailscale.com, we're happy to work from & with and credit early ideas as well.