Tailscale is using "being opensource" as a marketing term and it's working. The coordination server is a center piece of the architecture, the client being open is meaningless

Another example of this is Plex, many people don't actually know the fact that it went closed and that only the client is open source

Using an outdated version of a container (including DBs!) that have known vulnerabilities that will be very easy to exploits including by bots, is so much worse than the risk of a container breaking after an update. Just monitor your server properly and you'll be good

Keep in mind that no being accessible from the internet does not mean it is safe as your local network is ALSO a very hostile environment with modern technologies (especially your PCs, smartphones , smart TV, and so on). Make sure you use HTTPS, proper authentication and so on to protect your server