Maybe also mention that turning this off/on requires a reboot as processes may have the old state in their caches?

The new description is definitely better, but I'd guess it still doesn't mean much to most people. Tbh, before I was forced to look into it, I barely knew anything about the whole mechanism (not that I really understand a lot about it now…).

So maybe we should give a "real world" example. Something along the lines of "For example, this means you will not be able to see which dynamic user owns a file or directory."

I see the description mostly as a way to further discourage people to disable this. The default is to enable this, people disabling it will eventually read the description and don't disable it ;-)

@dasJ if I understood the NSS NixOS module properly, there also should assertions failing when any NSS module except the systemd one is enabled, but nscd disabled, right?

Yes, you are correct.