noopener opens the page without giving it access to the original page through window.opener. In older browsers without it, an untrusted page could use that property to tamper with the page that opened it.
noreferrer stops the browser from sending the Referer header, so the target site doesn't learn which page linked to it. It also implies noopener.
Modern browsers apply noopener to target="_blank" links automatically, so writing it out now matters mainly for older browsers. noreferrer remains a deliberate choice about privacy.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.