IME (compared to other distros I've used), NixOS actually goes in rather heavily on using the sandboxing features available in systemd.

For instance, most of my machines serve ~name/www as https://.../~name/, but this doesn't work out-of-the-box on NixOS, since nginx's sandbox isn't able to read /home by default.