if I setup Headscale on my network, I would have to open a port on my router to connect to it right?

The way I understand it is:

I would have to open a port on my router to connect to it right? Yes

if I setup Headscale with some cloud provider, could they theoretically go and use the setup to get to my home network? If they are able to authorize their own node to your Headscale server, then their node gets on your network. If they take over that node, they might also be able to access your network, either by changing Headscale’s config to auth another node or perhaps if the Headscale node is part of the network, which it might be, I don’t recall. But I think that’s immaterial. If someone takes over the Headscale machine, they can get on your network either way.