Right. More specifically, Nix itself can download files in this way, but the build scripts (in this case, the mkdir & cp part) are not allowed access so that the build is deterministic.