Tailscale would be the most “secure” as you have no ports open and only you can access it. Keep in mind your services will only be accessible by you along as all your devices connect to your tailscale instance. Sharing access is possible but will require some explanation.

Wireguard is another option, just as secure as the first option, it will need one port open but the port only responds if you are connecting with proper keys/authentication. Like tailscale you can only access your services if connected to your wireguard instance.

I disagree. Tailscale has a much higher attack surface since the network is controlled by a separate entity, tailscale. As on pure wireguard, you would need to first compromise one of your clients to get into the network.

Also tailscale is a much higher value target since you could compromise thousands of devices/networks/communication with ‘just’ compromising the vendors network.