RSA encryption secure mode, plaintext length limit vs. key length
Lets assume Java here. In that case the ECB part of the name is a misnomer. ECB is the most simple mode for a block cipher. It means splitting up the plaintext message into multipe blocks and then encrypting them separately. Java's RSA implementation doesn't split anything up, you can only encrypt a single block of plaintext. They should have used "None" instead or have left it out altogether.

Yes, OAEP is secure, if implemented correctly. It requires a mask generation function parameterized with a cryptographically secure hash function. You can compare MGF1 with a key derivation function. For that kind of usages SHA-1 is still secure. I'd still prefer SHA-256 none-the-less, if just to avoid nasty questions on the protocol. It is plenty fast for this kind of use and new processors even contain instructions to speed up the algorithm.

For the maximum plaintext message I'll simply refer to a previous answer. It lists a payload size of 214 bytes for SHA-1 and 190 bytes for SHA-256 if OAEP is used.