the changes that end up in nixpkgs are all reviewed by maintainers

They review the “recipes”, sure. But I don’t know if I’d trust that every diff of the source of every package update is reviewed by them.