It's not required but it’s a best practices to not get your secrets into the nix store. There are solutions like env vars or Agenix.
Either don't store your secrets this way or don't use Nix. Please.
/nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.