https://github.com/NixOS/rfcs/blob/master/rfcs/0097-no-read-... is relevant.

Oh hmm did we never implement this? We should. Both because it is a good idea, and because accepted RFCs should be implemented.

I'm not aware of it being done yet. But since the RFC is accepted it should be pretty straightforward.