Its much easier for the agent to look at a nixos module and decide that it should do `services.nginx.enable = true` vs reverse engineering everything it should do to install nginx on the system.

And likewise if theres an issue then its much more straightforward for it to unwind what it did in nixos vs a traditional software install and not accidentally mess with other users/services on the system.