COOP is unsafe-none
Cross-Origin-Opener-Policy is unsafe-none, which is the same as leaving the browsing context shared.
Why it matters
Other windows can keep window.opener and reach into this page.
What to do
Set same-origin, or same-origin-allow-popups if popups must talk back.
Reference
COOP isolates the browsing context unless explicitly relaxed.