Software Heritage is also helpful here, and Guix is integrating with it - see e.g. https://guix.gnu.org/blog/2019/connecting-reproducible-deplo...
Nix is also integrating with the Software Heritage:
Debian's archive reaches back 15 years now: https://snapshot.debian.org/
It also contains source code.
I'm currently doing some work for ML and data science companies where full reproducibility and introspection is very much desired.
So you need to run your own source cache to provide that guarantee, because you can't count on cache.nixos.org still providing the source code from a package built 4 years ago.
But that's why I love the IPFS cache efforts. [1] Running your own node to pin all required sources should then be relatively easy.
[1] https://blog.ipfs.io/2020-09-08-nix-ipfs-milestone-1/