JSF provides ExternalContext methods to operate with cookies. I think implementation of HTTP cookies will be the main problem with wrapping such functionality as a component - cookies should be added before response is committed, however component rendering won't guarantee this.
Yes. I understand that practically it works because these's always some sort of buffering and we even can add some cookies at the moment when a part of response already has been put into the stream writer. So the main problem is that JSF is not a complete MVC and thus M and C are not always before rendering V.