IFD is allowed, which is confusing

[vcunat]

ofBorg apparently allows to run stuff with import-for-derivation, which is confusing, as in nixpkgs we don't allow IFD. Example when this happened:
https://github.com/NixOS/nixpkgs/runs/56459739279

[gabyx]

This run was from NixOS/nixpkgs#441161 in a nixosTest
which I was not aware that it uses IFD due to some imageFile in dockerTools.