I'm not worried too much about the client software because it's open source and can be built from source, at least on the desktop.

I mitigate the potential risk of a compromised control plane by using secure protocols on top of Tailscale. Namely SSH and HTTPS with a custom CA and proper authentication wherever possible.