Yeah… it doesn’t look like that in any of the three devices I have. Spitz AX 3000, Slate AXT 1800, Beryl AX 3000. All updated to the latest 4.8, and tailscale updated to the latest version. Except maybe the Spitz AX, I’ll have to double-check the firmware on that one.
I’m looking at updating the zones per this other post (a condensed version of steps mentioned earlier in this one). The firewall zone looks like that after following those steps, with the exception of the third column (forward) being set to ‘accept’ as well.