There's no fixed standard. Publishers usually do things their own way and it will depend on the situation. For example, Microsoft approached acquiring Bungie for Halo to launch the XBox. Sometimes studios are running low on funds, so they seek a publisher to support them until the game launches. They can reach out to each other directly, there are usually entire teams whose job is to manage these relationships. Alternatively, they could have networking events in industry conventions like the GDC (Game Developers Conference).

For 3 specifically they don't do this randomly. They will negotiate terms for a contract that both parties will have to sign. It's a contract where the publisher is selling their services for a price. In the software world, outright IP theft of things like game engines is rare because it's really easy to get caught. The publisher really only has to look at the distributed game to spot clear markers of it being based on Frostbite. Having a past record of good projects will definitely give the developers an easier time negotiating a contract over someone that doesn't. A publisher could definitely opt to publish a game with only a pitch from a studio with no experience if they wanted to. It's just not likely and more often than not they're going to ask for at least some evidence that they're not wasting their time.