They are patched up regularly. The COBOL code itself maybe not, but the runtimes?
You are correct, the OS is patched regularly but that doesn't require a recompile for the COBOL code, the OS ABI is stable and unchanging for legacy code. I have programs still running that hasn't been recompiled since 2005 (maybe earlier that is just what I noticed recently). When they upgrade hardware, they can do it per LPAR. They just shift the workloads over to other LPARS while they are upgrading another. Pretty much zero downtime.
Yep. CICS, IMS, etc. all get updates along with z/OS itself, yet I had once plugged in an user exit written and compiled before 64bit z/OS existed and it just worked.
They absolutely are. Modern COBOL (even 25 year old COBOL) isn't running on ancient System360/370/390s or something, it's running on modern z/OS mainframes.
Yup, Z/OS even has an AIX subsystem these days. I have had to use it for some java decryption software and to use it to do some ebcdic to ascii conversion.