Because of risk and greed.
Your #1 and 2 go hand in hand... Vendors sunset their support for "legacy" software after a few years, to monetize the new stuff. That means you need to maintain yourself if you don't want to pay through the nose. Unfortunately, there's fewer and fewer people that can maintain it, since COBOL developers are retiring. There's a risk of "what if it breaks" ("My IBM mainframe is physically dying and we need to migrate the software to a new machine, but we don't know how"), but also risk of "what if we suddenly need a new feature"? CEOs / Boards of Directors don't like risk, so they'll ask how to mitigate it... and it's never "maybe we should have a core group of developers that knows the software we need to operate, and we hire young blood and train them to keep our stack running", but always "let's modernize and outsource the support to someone else".
I wish software was like a fastener. Unfortunately software is not a fastener, it's the end product. If I build you a deck with pinewood and screws, the pine and screws are COBOL, and the deck is the software. There's no need to change the deck unless it rots, but if it does, you better hope you can buy materials to fix it. And if at that time no one knows how to use a screwdriver, or how the deck was built... well tough luck. What's happening now is your deck isn't rotten, but everyone tells you "please rebuild the whole deck with metal and rivets, we don't know how to use wood / screws AND WHAT IF THE WOOD BURNS"...