You are correct, the OS is patched regularly but that doesn't require a recompile for the COBOL code, the OS ABI is stable and unchanging for legacy code. I have programs still running that hasn't been recompiled since 2005 (maybe earlier that is just what I noticed recently). When they upgrade hardware, they can do it per LPAR. They just shift the workloads over to other LPARS while they are upgrading another. Pretty much zero downtime.

Yep. CICS, IMS, etc. all get updates along with z/OS itself, yet I had once plugged in an user exit written and compiled before 64bit z/OS existed and it just worked.