Because nixos manages your system and nixpkgs only contains packages. Packages cannot do anything outside their installed location, so can't touch udev or group

Because nixos manages your system and nixpkgs only contains packages. Packages cannot do anything outside their installed location, so can't touch udev or groups to make the changes. There will be other apps split in the same way. The benefit is that just adding some package will never break your own configuration.