Though I’m assuming with this method there are privacy risks.

Supposing that you want to host someone on your Btc pay server, and the umbrel raspi is accessible via tailscale (the method you described), they have access to your umbrel. If you run a Btc node & lightning node (required for btcpayserver app on umbrel), they have access to it.

If you linked a wallet to the node, they have access to that as well, correct?