The risk is real. When some site has a link with _blank to your site, the opener site stays accessible for javascript code that is embedded in your site.