I was expecting DDG to be one of them (before I read the report), so I did some digging and it seems that they have <https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...> set to "origin", meaning it says that the request came from duckduckgo.com but nothing further

  <meta name="referrer" content="origin">

But, to answer your question, presumably a search engine that wanted to stay really under the radar could use that same mechanism to choose "no-referrer" and the traffic would seem organic

(I also had a good chuckle at them choosing to break the typo chain with this directive)

Referrers (or cross-domain referrers) can be easily disabled in the browser - it's not just up to the search engine.