that command is not restricted, it is the opposite

nixos/modules/deployment.nix

@@ -47,7 +47,7 @@ in {
     # Configure the deployment user.
     users.users.deployment = {
       # Without some shell no login is possible at all, even to execute our
-      # restricted command.
+      # single non-restricted command.
       useDefaultShell = true;
 
       # Without a home directory, lots of tools break.