Link errors on darwin caused by darwin.CF

Yes, a setup hook

is enabled when darwin.apple_sdk.frameworks.CoreFoundation is used

It seems like Cocoa depends on AppKit, which depends on Foundation, which depends on CoreFoundation: https://github.com/NixOS/nixpkgs/blob/8436842aaf7f3b6bbe7fe2d755ab0d6cc75155bf/pkgs/os-specific/darwin/apple-sdk/frameworks.nix

It would appear that the cf-setup-hook.sh prepends the -F flag, so they should always come first. If that is not the case, it could be because of a bug. You could file an issue to Issues · NixOS/nixpkgs · GitHub. If you do, please, include a minimal reproducing example.