For me, the difference is that there is no way in hell that I want to give an AI assistant full access to configure my system live. With a declarative config, the only access it needs is to an isolated git repo.
Well the main difference is precisely that I have a clear opportunity to read and understand the declarative file.
But even if something were to sneak in there, rolling back is now trivial.