But if the declaritive file is not read/understood, what is the difference? At some point, you're gonna run sudo nixos-rebuild, and that is the whole system on the line.
Well the main difference is precisely that I have a clear opportunity to read and understand the declarative file.
But even if something were to sneak in there, rolling back is now trivial.