ah yes, good catch, I didn't know Debian/buster did that:
~ $ ls -l /
lrwxrwxrwx 1 root root 7 Apr 8 2019 bin -> usr/bin
Interesting, this works now:
firejail --noblacklist='${PATH}/nc' ssh \
-oProxyCommand="/usr/bin/nc.openbsd -x 127.0.0.1:9050 %h %p" testserve

