Looks like NixOS creates a security wrapper for this already, FWIW.
update nixos/modules/programs/kbdlight.nix to use mkEnableOption