I think it's so invasive that they ship this per default. But thats the business model i guess.

I've always had to manually enable this feature. I've never experienced it on by default across multiple platforms and deployments.

I've never used it once. don't even see the point. normal ssh works fine over Tailscale.

What is the advantage? Why would I want to swap the well tested auth in ssh for auth managed by tailscale?

It's handy to open a TTY connection in the browser, or to delegate your tailscale MFA account as remote authentication.

Do they ship this by default? I thought it had to be enabled: https://tailscale.com/docs/features/tailscale-ssh#configure-...

Tailscale SSH is not enabled by default.

It’s also not even available on some platforms afaik

How do you mean? You have to run a command to enable tailscale ssh, it isn't on by default.