rel="noopener" not being added in normal external links is actually correct behaviour because @codinghorror is TL4 and tl3 links no follow is disabled.
rel="nofollow noopener" being added for @zogstrip (TL4) is a bug and onebox should respect the site setting tl3 links no follow.
There is a bug report for this here:
If the user is TL3 or above, rel="nofollow noopener" not being present is correct / as expected.