You are absolutely correct about the relatively small quantity of cobalt exposure. The reason the EPA has no limit on cobalt in drinking water is that it has not been recognized as a problem. At least, not yet. It seems like every year, another limit is placed on some contaminant, for good or bad. The term "heavy metal" is a really soft term that was applied to just a few metals many moons ago. Since that time, it has come to mean anything on the Periodic table that is left after chopping off the appropriate groups like halogens, alkali metals, etc. As a result, the term includes so many metals that it is essentially worthless.
As for finishes being food safe once fully cured, that is correct. The issue is the term "food safe". That means the finish can be in contact with food. It does not mean that the finish is safe to eat. As was pointed out, lead paint was banned because children were actually eating it. It also happens that lead from various pigments can be leached out when in contact with acidic food so it really was not "food safe". The metallic driers in modern finishes are safe when used in a finish that fully cures and the finish is not actually eaten.