nixos/boot: hint nixos-rebuild build-vm-with-bootloader

as that is one of the last boot methods that doesn't support initrd secrets

nixos/modules/system/boot/stage-1.nix

@@ -699,16 +699,18 @@ in
             (builtins.isString source && hasPrefix builtins.storeDir source))
           (attrValues config.boot.initrd.secrets);
         message = ''
-          boot.loader.initrd.secrets values must be unquoted paths when
+          boot.loader.initrd.secrets values must be unquoted paths
-          using a bootloader that doesn't natively support initrd
+          when using a bootloader that doesn't natively support initrd secrets, e.g.:
-          secrets, e.g.:
 
             boot.initrd.secrets = {
               "/etc/secret" = /path/to/secret;
             };
 
-          Note that this will result in all secrets being stored
+          Note that this will result in all secrets being stored  world-readable in the Nix store!
-          world-readable in the Nix store!
+
+          If you are receiving this error by running `nixos-rebuild build-vm`,
+          you want to use `nixos-rebuild build-vm-with-bootloader` instead
+          to build a vm with a bootloader that supports initrd secrets.
         '';
       }
     ];