Ya their comment does not match up to my experience at all. When I update my lockfile it very rarely breaks and if it does I just roll back a commit and wait a day and it's usually fixed.
In the very worst case, you update components individually until you find the offending one.
I've used both NixOS and nix-darwin for 2 years professionally now as daily drivers, and have had generally nothing but great success. I'm not fearing an OS update actively breaking my environment (which I can't say the same for macOS, as much as I am a fanboy of Apple).