Google has had the ability to harden SafetyNet checks using hardware-backed key attestation for several years now. The fact that they refrained to do so for 3 years has allowed users to enjoy root and Magisk Modules without sacrificing the ability to use banking apps. However, it seems that Magisk's ability to effectively hide the bootloader unlock status is soon coming to an end. It's a change that we've expected for years, but we're sad to see it finally go into effect.

but nixos has ways, you could look at how bootloader installation is done

After this, proceed to install the Syslinux boot code (mbr.bin or gptmbr.bin) to the Master Boot Record 440-byte boot code region

For a partitionless install, there is no need to install the Syslinux boot code to the MBR.