Personally didn't worry about it. Some issues in CoreOS with SELinux left a sour taste; tried to get my reverse proxy running, but a policy was missing and I either had to compile custom policies or turn off enforcement.

In NixOS, I was careful about checking file permission setup, service users and systemd service hardening options for the services I'm running. Defaults on what I installed seemed pretty good hardening, better than what I'd do myself.

I think it's easy to overlook as a first time user that everything in the nix-store is readable to all, so no secrets in there, anywhere. I ended up using sops-nix.