The spread syntax in your function isn't necessary (you already create a new object with results = {}), and keyname creates a .keyname property not one with a dynamic name (same problem in using object.key instead of object[key] - you might want to revisit dot vs bracket notation). But the main problem is that your updateObject function doesn't update the object it was passed, rather it returns a new one - and you need to consider that in your recursive call. So it should be

function updateObject(keyName, newVal, object) {
  const results = {};
  for (var key in object) {
    if (key === keyName) {
      results[key] = newVal;
    } else if (typeof object[key] === "object" && object[key] !== null) {
      results[key] = updateObject(keyName, newVal, object[key]);
    } else {
      results[key] = object[key];
    }
  }
  return results;
}

Its pretty simple. We just loop through and find the key and then update the value. if its not found we call the function again. Most important is to return the updated value at the end of the function

This line var newData = JSON.parse(JSON.stringify(data)); is just so that we dont edit the original object as you requested

var data = {
  token: {
    id: "abcxyz",
    year: "2022"
  },
  order_data: {
    customer: "Bob",
    shipping: {
      country: "US",
      state: "TX"
    }
  }
}

const updateObject = (keyName, newVal, object) => {
  for (var key in object) {
    if (key === keyName) {
      object[key] = newVal;
    } else {
      if(typeof object[key] === "object"){
        object[key] = updateObject(keyName, newVal, object[key]);
      }
    }
  }
  return object;
};

var newData = JSON.parse(JSON.stringify(data));
updateObject("customer", "Test", newData);
console.log(data);
console.log(newData);

If you're looking for an approach that doesn't mutate your original (and really now, who wouldn't be? 😀) we can do this by breaking our object into entries mapping them to the new value if the keys match and recurring on them otherwise, then putting the results back together. The recursion stops when passed a non-object, simply returning it unmodified.

It looks like this:

const updateObject = (keyName, newValue, object) => 
  Object (object) === object
    ? Object .fromEntries (Object .entries (object) .map (
        ([k, v]) => [k, k == keyName ? newValue : updateObject (keyName, newValue, v)]
      ))
    : object


const data = {token: {id: "abcxyz", year: "2022"}, order_data: {customer: "Jane", shipping: {country: "US", state: "TX"}}}

console .log ('Before:', data)
console .log ('customer = "Bob":', updateObject ('customer', 'Bob', data))
console .log ('state = "NY":', updateObject('state', 'NY', data))
console .log ('After (original data non mutatued):', data)

.as-console-wrapper {max-height: 100% !important; top: 0}

Do note, though, that there is a real concern, however this is implemented, that there could be similarly named keys in different parts of the data, and that any technique would update incorrect ones. You might look to tools that set this by path, with something like

setPath (['order_data', 'customer'], 'Bob', data)

or perhaps

setPath ('order_data.address.state', 'NY', data)