The constants in cryptography that can be chosen arbitrarily are typically not likely to be good candidates for backdooring. The constants in cryptography that can be backdoored usually have requirements that make it impractical to generate them randomly in the first place.
But with enough degrees of freedom, it is clear that nothing-up-my-sleeve numbers lose their purpose.
Enough degrees of freedom absolutely do reduce the benefit from using nothing-up-my-sleeve numbers. A paper titled How to manipulate curve standards: a white paper for the black hat explains the math behind this risk for constants as used in ECC curves. Actual proof of concept code for a simple 32-bit pseudo-NUMS generator is also available. Although it may be better if everyone used the same constants, the risk is not so bad as to say that they completely lose their purpose.
who does guarantee that the sentence "expand 32-byte k" was not selected among thousands of similarly innocent ones ("expanding 32-byte k", "expansion of 32-byte k", "32-byte expanded k", ...) in order to hide a backdoor?
That particular instance is a constant which really isn't suspicious due to what it is used for. It simply needs to have asymmetry and be non-null. It is fed into the random function in ChaCha along with the nonce, counter, and key. If there was a special constant that could reduce the security of the ChaCha core, then an attacker could exploit it on their own by choosing a malicious nonce or counter anyway.
In light of the previous considerations, was a "nothing-up-my-sleeve numbers standard" ever proposed?
I am not aware of any proposed standard that can be used everywhere, for all purposes. This is because it's often required that constants have certain properties and can't simply be random. There are solutions to this though, such as that employed by the well-known Oakley groups, generated deterministically using $\pi$ as a constant in RFC 3526. The specific technique, designed by Richard Schroeppel, can be scaled to generate any large, pseudorandom prime for use as a constant without causing suspicions. It is specifically intended for Diffie–Hellman. The algorithm is as so:
$p = 2^n - 2^{n - 64} - 1 + 2^{64} (\lfloor 2^{n - 130} \pi \rfloor + c)$
Here, $n$ is the desired size of the prime in bits and $c$ is the smallest non-negative integer that satisfies $p,(p-1)/2 \in \mathbb{P}$ (i.e. that ensures $p$ is a safe prime, required for the properties of primes in DH) and $p \equiv 7 \pmod 8$. This equation proves that you can generate structured NUMS constants from unstructured NUMS constants (in this case, generating a prime from an irrational number). If we want $n = 2048$, we get $c = 124476$ (DH group 14). Note that this only works to generate primes.
If not, why not?
One common place where nothing-up-my-sleeve numbers would have a hard time being used is in the S-box for block ciphers. The S-box is better off being specially designed for good differential properties, and an S-box that is good for one cipher might not be good for another. Although you could use a totally random S-box generated using nothing-up-my-sleeve numbers, the security properties would not be ideal. An S-box generated without any rationale is likely to arouse the suspicion of cryptographers. This happened with the Russian Streebog hash function (GOST R 34.11-2012) and the Kuznyechik block cipher (GOST R 34.12-2015), whose S-boxes are generally believed to have been designed non-randomly, introducing a weakness that is very likely to be a backdoor.
The idea of backdoored nothing-up-my-sleeve numbers, while not new, is not something that many cryptographers have thought about. This is largely because most backdoored constants need to have special properties that are extremely uncommon. Take the NIST ECC curves, for example. These curves have parameters that some consider suspicious. They were generated by passing an ostensibly random input through SHA-1 and using the resultant digest as the constant. The idea is that weak curve parameters are rare enough that it would be effectively impossible to find them by luck, and generating a specific backdoored parameter would require a preimage attack against SHA-1, which is thought to be infeasible (read: not gonna happen). It would be incredibly unlikely that there are so many classes of curves with weak properties that one could find them among a pool of random (due to SHA-1) curves but that cryptographers would not know about.
