Secrets handling is indeed an issue, you can shoot yourself in the foot if you are not careful. If you are careful you can avoid it though and it is not neccessarily difficult. It is certainly is one aspect of NixOS that requires care and can be improved. But to me, it is not so bad as to avoid it. The advantages outweigh the disadvantages with a wide margin