If the lack of the -e flag wasn’t a problem, however, I would use a wrapper script rather than a symlink, since it gets around the complications of security wrappers:
environment.systemPackages = [
(pkgs.writeScriptBin "sudo" ''exec doas "$@"'')
];
Your wrapper works. However, TRAMP shows an error because doas can’t handle the flag passed to it by TRAMP (it refered to an option H, if i remember correctly).
Thank you anyway - i now know, how to wrap something in the future!