Why? Are you referring to the fact that it's opt-in; you have to use `cargo build --locked` or `npm ci`?

I interpreted the parent to mean that it might not be fair to assume existing package managers have done a _great_ job at downloading and verifying, especially verifying, resources from the network. There are businesses that exist attempting to solve this problem like socket.io. Safely installing the correct dependencies for a project is still not a guarantee from any of the major package managers.

If the underlying package eco system is a mess then it’ll also be a mess in Nix. To this day Nix doesn’t really have a good answer to Python or JavaScript packaging.

If the underlying package manager is good (Rust, Go) then there’s just no need to reinvent the wheel.