There are unfortunately lots of software packages that don't offer a convenient passwordFile option in nix and the easiest way to get running is to specify a password in a way that ends up in the nix store.
I knew of a few options like that, but didn't realize it was so widespread. I wish Nixpkgs had a policy against writing modules that way. This creates a policy nightmare for companies that might use Nix. Alternatively, we need ACLs for the Nix store, or at least some store paths, at a minimum. :-\