The Nix daemon itself still uses root at build/install time for now. NixOS doesn’t have any built-in sandboxing for running applications à la Docker, though it does have AppArmor support. But then, NixOS doesn’t generally have applications run as root (containerized or otherwise), unlike Docker.

It’s not, though. Git is a means of distributing content, not the content itself. The thing analogous to PornHub’s porn on GitHub is the source code in the repos hosted there, not Git itself.