“Shockingly, the whole world doesn’t use Tailscale.”
Funnel lets the public internet reach a service on your tailnet, which is the opposite of why most people installed Tailscale. It takes two opt-ins and never terminates your TLS, so the ingress only sees encrypted TCP. That’s the right design. It’s still a front door into a private network, and it’s the one admins will forget they opened.