Wasm cannot indeed do much beside manipulating it's own memory and pure computation. Anything interesting happens via "imports", which are arbitrary functions implemented in JavaScript.

The networking capabilities are implemented via a JS API (itself, compiled from Go to WebAssembly/JavaScript). This Go library connects to Tailscale DERPs via WebSockets to provide network access to the Tailscale network of each user. The broader internet can then be also accessed if an exit node is configured.