How so? A Debian package can run arbitrary code as root on install. A Nix script can hardly be unsafer than that.
Ah. Good point. I expected dpkg to handle data blobs that were allowed to be moved into specific locations. I guess that would make post install configs impossible.