It's so unusual that I'm starting to wonder if this was intended to harm Tailscale's public image. These don't appear to be major flaws, and if the purpose of publishing was to get them fixed there's a well known process for responsible disclosure. Sounds like they didn't even attempt to follow that.