In absolute terms, honestly I'm not sure it is that big of a deal; default protection is HTTPS, and GPG is easily available. The only obvious issue that I see is that nix might be vulnerable to the truncated-stream issue; I forget whether that can happen over HTTPS or not.
So comparing https://nixos.org/download.html and https://guix.gnu.org/manual/en/html_node/Binary-Installation... - nix is curl | sh from a https address; guix is wget && chmod +x && run shell script. Both also have a trivially-available way to do GPG verification before running anything. So I'd call them pretty close.
In absolute terms, honestly I'm not sure it is that big of a deal; default protection is HTTPS, and GPG is easily available. The only obvious issue that I see is that nix might be vulnerable to the truncated-stream issue; I forget whether that can happen over HTTPS or not.