Hmm, yes, I think you’re right. Tailscale does handle the connection here, not Wireguard.

I’ve digged into it a bit and I believe it first connects over a relay, then the devices try to find a more optimal route. So for LAN, they would exchange their local IPs and try to connect over those. If they are indeed on the same LAN, they connect directly: https://tailscale.com/kb/1257/connection-types

This is not without issues, however: https://github.com/tailscale/tailscale/issues/7206