ah yes, good catch, I didn't know Debian/buster did that:
~ $ ls -l / lrwxrwxrwx 1 root root 7 Apr 8 2019 bin -> usr/bin Interesting, this works now: firejail --noblacklist='${PATH}/nc' ssh \ -oProxyCommand="/usr/bin/nc.openbsd -x 127.0.0.1:9050 %h %p" testserve