...and their solution is running an antivirus scanner rather than stepping back and realizing that they're shooting their own feet clean off. And it's based on an absurd premise! Seriously:
> binary form, which is essential for low-friction compatibility with popular language-specific build systems
What? No it's not! Worst case, build in a container with the official tools. Best case, package the build tools like every other distro and enforce source availability and build reproducibility. I mean, NixOS is a bunch of volunteers doing (a better version of) what you're claiming is impossible!
(Granted, I assume the claimed reason is a lie and the real reason is to support proprietary software, which is... maybe reasonable, but pretending otherwise isn't.)