Yes, this only involves their wrapper that is managed by ACL rules.

It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling

Their fix just future-proofs it in case the same bug gets reintroduced.

A proper fix is not to shell out to a command at all; use getpwnam(3) or similar.

I've used it before to access my tailnet machines through a browser on a machine I can't download software on.

Convenience for the most part but in general, I agree. I like having it as an option.

Yeah pretty much just use tailscale as a vpn.. do one thing as they say.

I used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.