This still doesn't fix the "trusting trust" attack: which Guix actually can, and which can bootstrap sideways to build other distros.

It also doesn't do anything which regular packaging systems don't (nix does have some interesting qualities, security ain't one of them): I.e. that big list of dependencies isn't automatic in any way, someone had to write them, which in turn makes it exactly the same as any other packaging systems build-deps.