Nixos-install with custom flake results in /boot being world accessible

[pancho]

It’s been recently reported on disko.