Which unfree packages are allowed is configured at the flake level via an option.
That is then used in the configuration of Nixpkgs.
See definition at unfree-packages.nix.
See usage at vscode.
The value of this option is available as a flake output:
$ nix eval .#meta.nixpkgs.allowedUnfreePackagesThe set of NixOS hosts is defined via an option which accepts deferred modules. Differentiating the hosts as a subset of the NixOS modules allows us to map over the hosts both when generating NixOS configurations and when defining checks for the flake.