It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.

What systems have pure reproducible builds? Does Nix? Any others? From what I understand, it is a very difficult problem.