The end goal is to have no reliance on tailscale as i am preparing for the eventual enshitification.
Tailscale is mostly open-source. If they do anything bad then someone could fork the project. The coordination server isn't open-source, but you could self-host Headscale as a replacement.
If it still doesn't suit your use cases, there's some alternatives.
I personally wouldn't directly deal with iptables or nftables rules, and instead use some other software to deal with that.