I don’t think anyone blame tailscale here. They are doing the right thing by going the extra mile and reflect on what could have been done better

Your mindset is the exact one responsible for these kinds of issues. Cybersecurity is as much a design and psychology problem as it is a technical one. The freaking article goes into detail about the dangers of defaults.

You know how I know you didn't read the article?

You can't blame a hammer hurting a user when they were being stupid, but if the default configuration of the hammer is to be made of a material that can bounce back with force and stick in the users forehead then some reengineering may be needed.

That's what this article is about. Better configurations and defense in depth. This is actually a wonderful position for the company to think about and take.