There is no redistribution happening, as I believed that would violate the terms of Roon’s license. Admittedly I did not bother actually checking that, but better to be safe than sorry.
The package is marked as unfree in Nix, which means it is not built or cached by Hydra, so when a user attempts to evaluate the derivation, the Nix build kicks in and fetches the package source (the binary tarball) and packages it locally. You can read the package derivation, which I maintain, here: nixpkgs/default.nix at master · NixOS/nixpkgs · GitHub
So, to answer the question concretely, end users are downloading from roonlabs.com directly when evaluating the roon-server derivation. This is why the unstable download link is especially bad, as it means a new user of roon might have their build fail (since the link changed the tarball it downloads) while an old user might not notice anything at all (since they have the package cached locally).
Our current “solution” is to use the web.archive.org cache to download specific snapshots of what the tarball link points to. It’s hacky, annoying, and we’re not even clear whether those web.archive.org snapshots are themselves correctly licesed/copyrighted.
Hope this clarifies things!
P.S. Users should virtually never use nix-env and opt for nix-shell for imperative package usage. If you want something permanently available on your system, do it declaratively via home-manager or configuration.nix. There is a roon-server module which I also maintain.