In reply to @adtya:adtya.xyz
I've just noticed that all the symlinks created by home-manager are pointing to files in the store which are owned by root:root and are rwxrwxrwx. is that how it's supposed to be? shouldn't the files be owned by the respective user? I never noticed this before

Nix is pretty much built on removing per-user restrictions (running user is a type of undefined build input), so home-manager inherits that property by being built on it (I think the linked files are rwxr-xr-x though). In general, if you're worried about other users modifying the data, the file would be considered "sensitive", so you'll have to try to encrypt it to be safe.

There are some tools like sops-nix that achieve this at an OS level in NixOS by encrypting the files and relying on external keys, but those keys need to be on an encrypted drive to be secure. Trying to achieve this at a user level typically is done by hooking into the system PAM modules to pass your login password to some secrets-manager like gnome-keyring or pass-secret-service, or using an encrypting filesystem like ecryptfs or however systemd-homed does it