That was solved decades ago with static linking. The bane of distro management is keeping everything as up to date as possible without breaking things.

And the bane of static linking is that a vulnerability in say libc will require the re-compilation & upgrade of a gazillion packages.

Exactly. And is the result different from keeping old versions of libc around and linking all programs you haven't updated against it? From the description, that's what this system does.

If dependencies never change in place, you're emulating static linking with a dynamic linker.

With ubiquitous high bandwidth and huge disk drives, that doesn't seem to be as much of a problem as it used to be.

Yes, but you are still at the mercy of whoever is statically building (and packages) your binaries. Bad for binary linux distributions, worse for proprietary software.

Nix model is that you work with expressions that allow to build packages from source. Binary packages are provided in format "if you performed build described by hash X you would get the contents of this archive".

For proprietary software, you have to consider the binary as-distributed "source" and build a version with proper dynamic linker an library path. Some third party binary wouldn't run as-is on NixOS, but there is a package that sets correct linking settings post-factum.