you could check this:

       If $SYSTEMD_RELAX_ESP_CHECKS=1 is set the validation checks for
       the ESP are relaxed, and the path specified with --esp-path= may
       refer to any kind of file system on any kind of partition.

       Similarly, $SYSTEMD_RELAX_XBOOTLDR_CHECKS=1 turns off some
       validation checks for the Extended Boot Loader partition.

environment.systemPackages = [
(pkgs.writeScriptBin "nixos-install" ''
  export SYSTEMD_RELAX_ESP_CHECKS=1
  exec {pkgs.nixos-install}/bin/nixos-install "$@"
'')
]

https://github.com/systemd/systemd/issues/12468#issuecomment-698782077

And yes, sd-boot writes to the ESP if boot counting/boot assessment is enabled.

 nix eval .#nixosConfigurations.boop.config.fileSystems."/boot" | nix run nixpkgs#nixfmt-rfc-style
{
  autoFormat = false;
  autoResize = false;
  depends = [ ];
  device = "/dev/md/esp";
  enable = true;
  encrypted = {
    blkDev = null;
    enable = false;
    keyFile = null;
    label = null;
  };
  formatOptions = null;
  fsType = "vfat";
  label = null;
  mountPoint = "/boot";
  neededForBoot = false;
  noCheck = false;
  options = [ "umask=0077" ];
  overlay = {
    lowerdir = null;
    upperdir = null;
    useStage1BaseDirectories = true;
    workdir = null;
  };
  stratis = {
    poolUuid = null;
  };
}