So in the case of Nix, i am still unsure if, for example, i had a Nix config for some software (say whisper-ctranslate2), is that permanently portable? Is there a way to make it so? Right now, with stuff that needs a GPU, the only guarantee i've found is to either do pcie passthrough and use a CoW VM that does incremental backups to NAS, or, if the publisher provides, a dockerfile / container.
For nearly everything else, i use a rolling release server OS and keep stuff up-to-date. bleeding-edge sci-tech, being publish or perish, doesn't much care about the published code working much past the git push.
For comparison, every time i've tried to use a node.js distribution of a package, there's some blocker because a pulled-in library version is vulnerable, and i'm even less likely to be able to fix that than some C++ or python thing.
If there are vulns, and you are using software from nixpkgs, there are tools to get yourself notified about vulnerable packages.
If you want to run vulnerable software on-demand, you can just boot the machine/vm up when needed? If you want to patch stuff yourself, nix makes it trivial to apply your own patches to already packaged software.