I ufw deny 53, but an nc scan reports a successful connection

ufw does not block any localhost connections. These are always allowed.