Is it safe to open up an old AED that's been sitting unplugged for years?

The safest way to handle that big internal capacitor before you crack the casing open is to measure the voltage across its terminals first. Assuming it's still holding a charge, you don't want to short it out or risk getting a nasty surprise. A multimeter is your best friend here, and you need one rated well above the maximum possible operating voltage of the device since you don't know what it's capable of. Checking the voltage gives you a good idea of how much energy is still sitting in the unit.

Once you have confirmed there's a measurable charge, the proper way to drain it is by connecting it across a suitable load. A power resistor is exactly what you shold use; it acts as a controlled bleed-off for the stored energy. You want a resistor that can handle the current without exploding, but you are mostly concerned with letting the charge drop safely over a period of time.

Short-circuiting it, like with a screwdriver, is indeed the worst idea because it converts that stored high voltage energy into heat in a very small area, wich is just dangerous and unnecessary. A resistor allows that energy to dissipate in a controlled manner, reducing the risk of component damage or a spark when you finally start working on the internal boards. If you are just curious about its operation, you might find that once the voltage is down to near zero, the board is safe to inspect. You can then proceed with tearing it apart, but always keep that high voltage risk in mind since you're dealing with medical-grade electronics that were built to withstand serious power. It's always best to work on these things in a dry, well-lit area, and make sure you don't touch any other components that might still be live. This method allows you to see the residual charge and then safely bleed it off before you start poking around the internal circuitry.

I usually skip the resistor method and go for a simpler load dump. Even if you measure it, residual charge from these things can linger long after you think the job is done. I’d rather just bleed the current into a heavy work light or something. It’s a quick way to drop that stored voltage to ground without getting bogged down in calculating appropriate resistance. Once the light stops getting hot, you can be sure the main circuit is safely dead before you start prying panels off.

I think you should check for any obvious safety warnings or labels on the circuit board itself. Some of these older units have little markings indicating the max voltage or even a maintenance release procedure. You don't want to guess when you're working with medical grade electronics. Once you've got it safely drained and it's confirmed at zero volts, what kind of primary fuse or safety switch should I look for first? Is there ussually a simple one near the power input?