As far as i understood tailscale funnel its just a TCP-tunnel.
So you handle TLS on your own system, which makes sure tailscale cannot really interfere.

If you already trust them this far, might aswell do the same with a VPS and gain much more flexibility.
I'd connect the VPS and your home system via VPN (you can probably also use tailscale for this) and then you can use a tcp-tunnel (e.g. haproxy), or straight up forward the whole traffic via firewall-rules (a bit more tricky, but more flexible and can preserve original source IP without PROXY-Protocol, which doesnt always work, but do what works and is easy).
This way you can use all ports, all protocols, incoming and outgoing traffic with the IP-Address of the VPS.

And as you terminate TLS on your home-system, traffic flowing through the VPS is always encrypted.

If you want to go overboard, you can block attackers on the server before it even hits your home-system (i think crowdsec can do it, the detector runs on your home-system and detects attacks and can issue bans which blocks the attacker on the VPS)

And yes, its a bit paranoid.. but its your choice.
My internet connection here isnt good enough to do major stuff like what i am doing (handling media, backups and other data) so i rent some dedicated machines (okay, i guess a bit more secure than a VPS, but in the end its not 100% in your control either)