So the first issue here is that the embedding doesn't work as the path to the var is wrong.
You can check with strings result/bin/az-pim-cli | grep v1.6.1
The following patch fixes it to point to the version var in cmd package:

diff --git a/pkgs/by-name/az/az-pim-cli/package.nix b/pkgs/by-name/az/az-pim-cli/package.nix
index 4ff1e44032e7..b27dda9ffaad 100644
--- a/pkgs/by-name/az/az-pim-cli/package.nix
+++ b/pkgs/by-name/az/az-pim-cli/package.nix
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X=main.version=v${finalAttrs.version}"
+    "-X=github.com/netr0m/az-pim-cli/cmd.version=v${finalAttrs.version}"
   ];

The other thing is that the embedded values will only be used if there is no debug.BuildInfo available, as stated here: https://github.com/netr0m/az-pim-cli/blob/e4bb4d7617a0561ae2fad3fb00c1e12d1548d5fc/cmd/version.go#L50-L53
And as the doc for that func say, it is will always available when build with module support. So you would need to patch that out for the program to actually print the embedded version.