Is this safe to use? What's the catch?

Is it safe to use? - it's Wireguard but set up by someone else, with the attendant quality-of-life things like user-friendly authentication and access control. So, 'probably'.

The catch is that you're using a service set up by someone else, ditto your email, your OS, and whatever horrible social network service you're also using.

Host a headscale server if you don't trust it