If you use builtins.fetchTarball, I don't think this is the case.
Since this all uses CAS, you can use the nix prefetch scripts to import an arbitrary file:// or other URI into the nix store.