I would go further: noreferrer should be the default. Alternatively, let each user configure it, as a privacy option.
On one hand, social media sites tend to want to tell the target site "we brought you there" for some pretty traffic statistics and monetization. On the other hand, I seriously doubt HN, the news site of a VC company, actually takes any money from that.