In the very worst case, you update components individually until you find the offending one.
I've used both NixOS and nix-darwin for 2 years professionally now as daily drivers, and have had generally nothing but great success. I'm not fearing an OS update actively breaking my environment (which I can't say the same for macOS, as much as I am a fanboy of Apple).
But with all due respect, asserting that everything outside of home manager is “not worth using” is fertilizer.
The fact that smart companies (TailScale and Shopify come to mind, but there are zillions) are willing to cope with those (obnoxious) gaps is very, very strong evidence that there’s a lot worth using.
git was considered too hard, inadequately documented, maliciously baroque for years before GitHub happened.
Nix solves a harder (and more important) problem in a similar way.
Some examples: managing patches for applications is doable with NixOS. With overlays they survive updates and if they no longer apply, build fail before they can have production impact. Doing the same with docker is a nightmare and different for every dockerfile without a common interface around it. Ansible takes the previous state of the system into account which is terrible if you want to manage it fully declarative. Worst case in NixOS you do a reboot and your config applies almost no matter the previous state.
And that you can leave something running without maintenance is naive and it will start to slowly rot.
My dotfiles managed by nix(-darwin) and home-manager breaks every time I update my pins, and I find myself having to bisect which commit introduced the issues. Given that, I just don't see how that would scale to a full OS, let alone to a team at work. 1000% better simpler with understandable Dockerfile and Kubernetes YAML manifests, or with Ansible YAML. At least every folk can StackOverflow and ChatGPT it to a working state, and have it work for a considerable amount of time without further maintenance.