It's a step in the right direction, but it misses one great feature of seccomp - you don't have to activate seccomp at startup.

What it means in practice is (for example) a daemon running under firejail must be able to open log for writing and open sockets. An application which uses seccomp natively can first do those things and then block all further open/socket syscalls.