When WITHOUT_NIS is set, some code in /etc/Makefile will edit the installed nsswitch.conf to remove NIS compat DBs and sources. When building with -DNO_ROOT, the size of nsswitch.conf is recorded in the mtree log before this edit is performed, so the logged size is different (smaller) than that of the edited nsswitch.conf. This results in a truncated nsswitch.conf if the mtree file is used with makefs to create a filesystem image, for example.
Eww. This is definitely a bug. nsswitch.conf should be generated under the all target so the right thing can be installed.