I infer from the wording around there and elsewhere in the RFC that this is mostly because someone could switch issuers but still serve valid certs from the prior issuer, and there's no way an RP would have a historical record of which CAA values were in effect when to be able to determine if the issuance was valid or not.

the first lets me provide locally hosted services without exposing them to the internet, by allowing members of the VPN ("tailnet" in their parlance) to connect to those services

the second was very handy to move a few users from a company in the process of shutting down to their homes, so they could continue to work like they had in the company network once the actual internal company network was shut down.

This is using the infrastructure tailscale set up for a different purpose. Rather than requiring a tailnet or even an account anywhere, you can tailcat between any two endpoint. Tailscale is there because it runs the DERP relays which get the client's pubkey to the server, brokers the connection, and coordinates holepunching.