This is slightly more verbose and inconvenient, but it forces you to think about what the wrapper ownership and permissions will be.
The binary will be in `/run/wrappers/bin` and adding `pkgs.iotop` won't have any effect. See also https://github.com/NixOS/nixpkgs/pull/51749#discussion_r254724170
The `iotop` program can't be started by an unprivileged user because of missing root privileges. The issue can be fixed by creating a setcap wrapper for `iotop` which contains `cap_net_admin`.