It shouldn't be automatically sending PRs for nix in the first place, right? Did you enable version updates? You can turn security updates off via https://docs.github.com/en/code-security/dependabot/dependab...

FWIW, I don't think security updates are turned on by default anymore, so new repos won't have this problem.