Statically linked, but you can replace the entire application. You'd get one or two private key signa before the user disconnects and starts wondering what happened (remember that you need to have something to sign).

Of course, without askpass, a properly patched evil sshmuxd could sign a separate session while still signing ths original.

As I have said many times, ssh -W ProxyCommand makes you immune to evil jump hosts, but if root on a machine in your network got compromised, as would be required, then you're going to have a bad day regardless.