I'm somewhat alarmed that the context that this bug was running in was capable of root login. Is there a reason that an SSH login process would, by default, have enough capabilities to facilitate direct root login?

you can also add parameters to env vars in some popular cloud providers for the same effect.

I've used it before to access my tailnet machines through a browser on a machine I can't download software on.

I used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.

Yeah pretty much just use tailscale as a vpn.. do one thing as they say.

Convenience for the most part but in general, I agree. I like having it as an option.

Yes, this only involves their wrapper that is managed by ACL rules.

as much as handing control to a remote third part is, yes.

It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling

That is what it's supposed to do, though. It's not a secret.

A proper fix is not to shell out to a command at all; use getpwnam(3) or similar.

Their fix just future-proofs it in case the same bug gets reintroduced.