The only way to protect against that is if a secure application boundary is enforced by the operating system. You can make it harder for other programs to uncover secrets by encrypting them, but any other application can reverse the encryption. I don't believe using the tpm meaningfully changes that situation.
Windows also bit me in the ass with this feature, but tailscale not enabling encryption wouldn't have helped one iota.