I don’t think OSTree systems can quite reach the flexibility of NixOS. For instance with NixOS (with direnv and nix-shells) you can essentially swap out your running system based on the different directories you enter and I think that’s still just scraping the top of the iceberg. From my experience with OSTree (which is admittedly somewhat limited) I don’t think you can reach that level of flexibility.
It’s still really cool, I don’t mean to shit on that, I’m just saying NixOS and OSTree have different pros and cons and use cases.
Though unfortunately (or I guess for most use-cases fortunately) you can’t find the m4/build-to-host.m4 file on there afaik. The best way to find that now, should you really want to, is by looking through the commit history of the salsa.debian.org/debian/xz-utils repository which is, as far as I understand it, the repository that the debian packages are built from and consequently also what the compromised packages were built from.