Nix also forces builds to be sandboxed. Now you actually need to run an infected build output to be affected.