At least until NixOS full supports -fstack-protector it's better to turn it off at the moment, as previous successful builds didn't include it either.