Unless you got a manual penalty from Google, these links are not the reason for your traffic drop - Google is very good at ignoring SPAM links like these, so in most cases, you can completely ignore it
You only need to disavow them if a big percentage of your links are from these SPAM websites, or if you start getting many of these every month.
rel="noreferrer" doesn't affect security.
It is for your own privacy (or for being secretive).
If your page has a link to a page on site-X, when someone clicks on it, the log file on site-X will record the fact that your site provided the link.
Generally this could be considered a good thing.
For instance they might notice that they are getting many ...