Did Tailscale not have a major vulnerability just a few days ago?

For a specific service only, not the networks. But that doesn't even matter that much - if you require the attacker to get both into the network and into the device, that's a significant improvement.