Just going to reply to your comment here: the choice to use wireguard shouldn't come down to relative security (although I guess it gets a benefit here), but from being fast and simplistic.

All of the traditional components of VPN management are removed from the core code. Wireguard follows the model "do one thing, and do it well." It's also built into the kernel, which inherently can make it faster than userland VPN software.

This is why companies like Tailscale exist--as they're basically selling back the features that you would get in a more traditional IPSEC VPN, but in front of Wireguard instead.