In core/includes/functions-extensions.php :
Propose adding rel="noreferrer noopener" to the <a ...> in responsive_get_social_icons()
Received wisdom is that this should be for both http(s): links and mailto: links to cover scenarios for browsers configured to handle mailto: protocol with a web app (reference)
Other than coming into line with WordPress behaviour (in Gutenberg) of adding these attributes to links, this will also reduce errors when assessing site with Google's Lighthouse tool.