This article suggests that Nix could have prevented xz backdoor, only to conclude that backdoor could be avoided by building from a git tag rather than source tarball.

This is true for every distro and it grinds me that Nix is even mentioned.