You do realize that updating is a non-deterministic process, right? The entire point of the nix language is to be deterministic. And the only thing these update scripts do is generate new nix code. It’s not like the nix part of nixpkgs calls that script during evaluation because “how limited the language is”. It’s literally just a script that does automated work for the package maintainers.