I think you’re right to be suspicious. The XZ attack has showed that there are people and organisations out there that would love to get hold of a piece of trusted critical infrastructure like Nix. They’ll go the long lengths to do it, manipulate people, and exploit the maintainer’s desire to do the right thing.

And if the person can’t stand by their critism and can only give wooly examples, then best to ignore it.