I vaguely remember, mostly I think because it is pointless?
-
noopeneris for security -
nofollowis for search engine safety -
noreferrer.. has no purpose other than “screw you, we’re not sending the referrer” .. plus http to https doesn’t send it anyway.
There is a pretty weak case to be made for it in terms of intranet leakage, but I would be unwilling to spend any engineering time on this unless a few paying customers request it.