Why exactly would they ever need to turn VPN off again? It’s not like all their traffic will go through it if it’s on, unless you specifically configure stuff that way (exit node, routes).

And one option to do the VPN stuff is on their router too, so it’s totally transparent to them. More stuff to configure though, unless running owrt or some other router software compatible with Tailscale.

As far as I understand, Tailscale (being a Wireguard network) doesn't need you to flip it off and on - if you're connecting to the relevant endpoint it gets routed through that, otherwise it just goes the normal way.

Not gonna pretend that means the setup is trivial to nomies, but you could probably set it up for them and not have to worry about it.