The suckless-tools apt package has a usable slock, and there are other screen lock solutions, but wondering how one might resolve this outside of NixOS.
Nix itself is not going to provide a solution for this. The permissions of the files in the store should never have those permissions set, and if you have a single user install, they should never be owned by root. You’ll need to copy the binaries out somehow after adding a gc-root.