The hub and spoke configuration bypasses firewalls and NAT, which WG can do natively.

Though doing this "well" is subjective, so I can understand someone preferring Tailscale because it's easier to use.

not familiar with wireguard per se, but afaik it's using udp-packets which get translated/mapped just fine by any NAT implementation. nothing in need of punching imho.

if your access concentrator (server) is behind a nat, you'll need a port-forwarding from the outside but that's rare.

Tailscale builds a mesh, where the participants can communicated directly, so it's common for all nodes to be behind a FW that does NAT. There is a very interesting blog post from tailscale about all the trickery they pull to reliably deal with NAT: https://tailscale.com/blog/how-nat-traversal-works/

i stand corrected. thanks!