How ICBO gets amplified to ICEO in BJT when base is open
I think you can't answer this with currents as above, instead you have to use charge flows, i.e. the drift of specific carrier populations.

Let's take an NPN transistor for example, with a supply connected between C and E to reverse-bias the CB junction.

At the micro level, what is ICBO composed of?  Currents in reverse biased diodes are from random thermal creation of hole/electron pairs, so in this case we'd find new electrons being pulled out of the CB depletion zone and flowing to the collector, and new holes being pulled the other way and flowing into the base.   Holes into the Base!  There aren't electrons in that P-doped region to swallow the incoming holes, so they can diffuse through to the BE junction, meeting up with electrons, and reducing the BE depletion layer thickness, so forward-biasing that junction.  (So, essentially the CB diode acts like a large resistor in series with the BE junction.)

But when the BE depletion zone narrows, the lowered barrier allows the vast population of mobile electrons in the Emitter to start crossing the junction into the Base region.   So:  small hole-flow from CB is turning on Vbe, causing large electron-flow coming from E.  (This involves hfe, just as when Base is connected, where Ib produces a small hole-flow into BE junction, lowering Vbe and producing very large electron current Ie ~ hfe * Ib.)

Carriers flooding across BE junction.  Electrons in the Base!  Some will be swallowed by holes, but since the Base is thin and lighter-doped, most will diffuse across.  When electrons arrive at the reverse-biased CB junction they're yanked across by the large e-field there.

Wouldn't this produce runaway, hfe*hfe*hfe...?   Nope, and neither does runaway happen in diodes: forward biasing DOESN'T trigger even more forward biasing and so a runaway.  It's because the BE junction is being forward biased by the holes (not electrons) coming from the Base region.   The large amount of electrons pouring in from the Emitter region don't turn on the BE diode any more than it already is.   Or in other words, Icbo is a hole-current just like Ib would be, and the large Ie doesn't reverse course while flipping its carrier polarity to make Icbo larger.  Icbo and Ie are separate clouds of carriers flowing in the same piece of silicon.  Icbo can "communicate with" the Ie via the BE junction-barrier and Vbe.  But the two don't interact directly, in the simple case.