> that this only applies to the one direct dependency on a package, but not on dependencies required by that package

Right now in nixpkgs we manage all dependencies in all packages front to back. So all dependencies of a dependency and dependencies of dependency dependencies and so on.