There is no such thing as a "nix dependency", Nix builds everything from scratch. You yourself control the whole software supply chain.

[It's still not a completely fixed problem - Nix needs to finish their content-addressable scheme, and for that you need reproducible builds; this is a detail, though.]