this is better than !^$ .. but why, what exactly does it mean?
You mean the -? tucked into the middle? It's insurance. Look at your logs and you will see that any blank element is recorded as "-" rather than, uh, nothing at all. This is probably just the logging software's way of noting "This category has no content". But one time I found a bona fide "" in logs so I figured it's safer to leave the -? in place.
In general the two forms ^$ and !. are synonymous.
2) Is google.*/blank.html only a referrer on a direct (stand alone) image or is it also triggered with hotlinking (image embedded in external page)?
Somewhere in the middle of that long long thread on image search I went off to experiment and came back with a depressing discovery: the image is pre-loaded, not just for Chrome but for everyone. The pre-load comes with the human user's IP and UA, but no referer. So there's no way for htaccess by itself to tell what's going on.
The only way to elicit the /blank.html referer-- the dead giveaway that you've got a "View Original Image" click --is if you start by serving up an uncached image. And, of course, hope that the user's browser obeys. You can then serve up a different image to users who click the link.
My 403's have gone through the roof by people going "up" a level from the current image folder
This belongs in large bold type, though not necessarily in this thread. People who have been in the www business for a long time forget that to an ordinary human, 403 doesn't mean "You evil robot, get back to the Ukraine and stay there!" It simply means "Sorry, no dice, I'm not letting you see the index of this directory". There's no straightforward way to make different 403 pages depending on the nature of the request. ("Straightforward" = without resorting to php.) But if it's practical you can make directory-specific 403 pages that include links to the gallery pages that you want your humans to visit.