Restrict the node local tabs access to specific content types
Yes, routing is correct. Routes specify access rules, if you want your route to only be accessible for a certain node type, implement custom access callback and check for that.

The local task will then automatically respect that.

Example from core:

comment.reply:
  path: '/comment/reply/{entity_type}/{entity}/{field_name}/{pid}'
  defaults:
    _controller: '\Drupal\comment\Controller\CommentController::getReplyForm'
    _title: 'Add new comment'
    pid: ~
  requirements:
    _custom_access: '\Drupal\comment\Controller\CommentController::replyFormAccess'


That method then can receive the same arguments as the controller/form, in your case the node (just add NodeInterface $node) and you can check the type there and everything else you want (like permissions)