> they make sure the user get a specific version that is (hopefully) vetted and know as working properly

This is exactly what nixpkgs maintainers do, using more reliable and explicit tools than the likes of pip. A significant effort is made to enable tests on as many packages as possible, meaning that when you get a package from nixpkgs, it has been tested against the exact dependency chain (down to the libc) it is being shipped to you with. If tests fail, issues are investigated and solved.

This is a far stronger guarantee than you get from almost any other installation method.