I feel that this could be better served with the mkOrder mechanism?

Please describe how you would image this be done? The chain input-allow chain contains as an expression the generation of allowed{TCP,UDP}Port{,Range}s, so there is no earlier injection point prior to that, not even a plain multiline string which you could modify with mkBefore or mkOrder. One could move the current body of the input-allow chain to extraInputRules, but then the final ordering would probably not be obvious? But then such rules could just be added using mkBefore.

You would have these default rules being added to the extraRules with a small order. For example, security.sudo.extraRules use this apporach:

How would one prevent this from getting messy when we have to deal with the ordering numbers? In the sudo case, the is probably not the intention for users to add rules to the beginning?

I'm not sure what you mean by "getting messy"? For user or for the module? In the module, it should just be a single extraInputRules = mkOrder 400 [ all existing default rules ]; and then just use cfg.extraInputRules to generate the chain, and users can use mkOrder 300 [ their rules ] to inject before the default rules?

Commit message of sudo module does mention injecting rules being one of the use case for the change: 93011e3

With messy I meant the mkOrder 300 [ their rules ](the consumers of the module) thing, but if it's fine for others I am fine with it ;)

BTW: to achieve the desired outcome in the motivation, I would actually suggest to create a different table to handle this. You can just register mutliple hooks in different tables, and nftables will traverse all of them, and any hook can decide to drop the packet.

I would recommend just to do

networking.nftables.tables.ip_drop = {
  family = "inet";
  content = ''
    set blocked-ip4 {
      typeof ip saddr
      flags interval
      auto-merge
    }
    chain input {
      type filter hook input priority filter; policy accept;

      ip saddr @blocked-ip4 counter drop
    }
  '';
};

Now you also have the flexibility of being able to dynamically modify the set.