What is reverse tabnabbing, and what do modern browsers do about target="_blank" links?

With window.opener, the new tab can run window.opener.location = "https://evil.example/login". The user comes back to a fake login page in what looks like your tab. Current Chrome, Firefox and Safari treat target="_blank" links as noopener. Still add rel="noopener noreferrer" for older browsers. Also pass "noopener" to window.open, which doesn't get the default.

"Runs scripts inside your tab" is the tempting wrong answer. The opened page can only navigate your tab. It can't run code in it. nofollow is an SEO hint with no security effect.