Substantially worse in my experience. They build the whole OS in CI which is slow and unreliable, and as a result it can take 2+ days for updates that other distros have out in under an hour. You can try mix packages from smash or unstable builds but for stuff like kernels that’s not simple.
> They build the whole OS in CI
As opposed to only building a part of the OS?
The quantitative data we have shows that NixOS is fresher than other distros in general by a significant margin.
See https://repology.org/repositories/graphs
If you pick a specific random package update, nixpkgs often has that update months to years before other distros.
If you pick a specific CVE, nixpkgs usually is better with the exception of embargoed ones, where Ubuntu, Fedora, etc get to prepare their patched packages ahead of time.