> Having nix-darwin uninstall brews not declared in the flake makes me stay honest about keeping my configuration up to date as well

Note that you don't need nix-darwin to achieve that. I keep my homebrew stuff separate from nix but still "keep myself honest" with this:

  HOMEBREW_NO_AUTO_UPDATE=1 /opt/homebrew/bin/brew bundle --file="$HOME/Brewfile" --cleanup --no-upgrade