I have no idea how to do that on tailscale as I use pivpn on a vps. It works on Norwegian airlines and SAS, but I assume other systems might block traffic differently.
It is possible to use VPN over DNS. Some mad lads back in the '90s made a DNS server that would forward TCP packets over name service text records. The captive portals usually still let DNS pass. But it's not like you're going to be able to use any high bandwidth applications that way.
If you call security trough obscurity a security measure, then it's really safe. Bots scanning for wireguard servers won't find yours because they'll be looking for the default port. In general wireguard will only respond to wireguard traffic, so a bot trying to exploit an ntp server will see silence as wireguard will not respond to actual ntp traffic.