How could it possibly work otherwise? Tailscale owns the WireGuard connection, so it gets raw packets from WireGuard before the kernel.
It could work like a full userspace network stack, getting the packets on the wire before (instead of) the kernel (network stack)?
How? (I can think of ways, and they're all horrible).
Well, that's certainly different from "all TCP port 22 packets" - I suppose some emphasis should be on "after the WireGuard decryption" (ie: over the wireguard interface). It's not entirely clear from the comment (but probably clear to engineers working on the tailscale code).
I read it as if tailscale snapped up packets before the kernel from (all) network interfaces...