NixOS containers, or systemd services or whatever, are not intended as a security mechanism. Neither are Docker containers, they've just gotten shoehorned into the role.

For security you'll need some other mechanism, but it does solve the immutability / replication problem.