They could steal your private keys, as could any program you install with root access
There you go.
and it’s open source.
Are you sure that what you download from https://tailscale.com/download is 100% open-source and the same thing that is published on their repos?
But it would comepletely destroy their business (...) I really dont think they have anything to gain by tricking everyone
Same goes for Cloudflare. Maybe Tailscale is secure and good people, or maybe they copy all keys to somewhere and covertly share them with govt agencies.