I don’t think those mainframes running COBOL are getting patched either.
They are patched up regularly. The COBOL code itself maybe not, but the runtimes?
They absolutely are. Modern COBOL (even 25 year old COBOL) isn't running on ancient System360/370/390s or something, it's running on modern z/OS mainframes.
They are patched up regularly. The COBOL code itself maybe not, but the runtimes?