Thank you luceos, but unfortunately this seems is NOT working 😐
I hope in the future a way to keep this setting / edit without loose it with updates.
For the temporary edit to improve security in
/www/wwwroot/flarum/vendor/fof/user-bio/js/dist/forum.js
Find: .autoLink({rel:"nofollow ugc"})
and change to:
.autoLink({rel:"nofollow ugc noreferrer noopener", target:"_blank"})
I hope in the future maybe a settings can let admin decide if open links in the same window or in new tab.
The fix found here is temporary and will be lost when user bio is updated.