AFAIK, it uses /nix/<hash>-PACKAGE/{bin,lib} or similar, where each
       executable is frobbed to refer to the right place.

   Is there one  of these for each installed package?
   If so, there could be hundreds of these in one machine, right?

Correct.

   When the user sets
       the environment, it frobs PATH to refer to each bin/ directory.

   Does that mean PATH is a list of hundreds of such directories?

As I understand it, yes.