It is all wireguard in the end, if you want to set that up manually then go for it. And you can self host headscale if you want to maintain that, but I think just using the free version of tailscale does fulfill a use case where dyndns used to dominate, which is accessing a lab or home network from a few specific devices in your own control. I see a greater risk in keeping a public exposure for remote access than from Tailscale causing an incident for that specific purpose.

If it is meant for public hosting that goes out the window of course. Tailscale has something for that but I have not used it. This is all my honest recommendation, I have no affiliation.