Legacy is certainly a large chunk of it. The vast majority of Fortune 500 companies have been using IBM mainframes since the 1960s or 1970s, and some were IBM "shops" before computers were invented.
The cost of moving software and data from a proprietary IBM stack would be enormous, even if you could guarantee that it would work. However, the failure rate and cost overruns that appear to be endemic to very large systems development (including IBMs) make moving a risky proposition.
The average CEO is focused on quarterly numbers and is unlikely to stay around for very long. If IBM mainframes were in place decades before the CEO arrived, and will likely be around for at least a decade to come, why take the risk?
It's also easy to imagine a future where compute workloads begin to dramatically trail behind compute power and space requirements. Then, you've got one of these Z13 mainframes the size of an Apple power adapter plugged into the wall of every home.
Maybe we wouldn't even need cloud providers anymore.
Basically, highly transactional workloads that have severe performance and reliability requirements. If you're serving a web app, maybe you can spin up a bunch of instances on AWS because while performance and security are important, they're not that important. And by "not that important", I mean not important enough to spend hundreds of thousands of dollars on. To a large consumer bank, it is that important. You also may be able to get away with having an eventual consistency model because it's okay if two different users see two different views of your app. But that's not okay for a bank processing credit card transactions, so they are forced to deal with highly transactional workloads which are now consistent.
I had the same questions as you did, but after talking to some of the z systems folks, I think it may be the case that mainframes, or things that look like mainframes, will always be around. Consider that basically the entire consumer banking and insurance industries still use mainframes. It's possible to consider that an artifact of legacy, but it's also possible evidence that their use-case doesn't fit well with the alternatives (clusters of smaller systems).
Disclaimer: I work for IBM Research, but not in this area.