1) Does it mean old .net core libraries installed on servers needs to be removed?
best security practices say yes.
2) Is it done by MS patch updates or we have to remove them?
you need to remove
3) Can old libraries remain on the servers without security vulnerabilities
not a best practice.
4) Is App build/test and redeploy needed to have them run on patched versions of libraries? E.g. 3.1.1 to 3.1.27 or 6.0.1 to 6.0.7
depends. if self contained release, a build and redeploy is required. if using shared installed libraries no.
5) Is App build/test and redeploy needed to make them run on new major versions e.g. 3.x to 6.x of .net core
yes. you also need to update the version in the project