Well, it’s even less reproducible than channels, since you don’t even control when it updates. However if that’s ok with you, there’s nothing really wrong with it other than that.
The more proper way to do this is to pin the commit of nixpkgs in your code and update it yourself along with the hash. There are various systems for automating this, including flakes.
There is no difference. Certain builtins are accessible directly, rather than going through the builtins attrset, but they’re the same functions either way.