It downloads to the /cache directory on the root not in any folder. There will be 2 files, the update itself and a .crc file with the same name. You must be rooted to access the /cache directory with a file explorer and remember to select to run it later after downloading. The /cache directory is always wiped by the update after it flashes, so you must get the file first before allowing it to run or it will be deleted.
It does not give the option to install later. I can see it in /cache while it is downloading but when it is done it tries to install and says "could not validate package" then the file disappears from /cache.
The way to flash just the baseband is to make a update.zip file containing the baseband and an updater-script to apply it; don't worry about signing the zip. While you're poking around in the zip file, save a copy of the update-binary.
The update.zip signature handling is done by recovery, after recovery is happy with the signature it extracts update-binary and feeds it the name of the zip file and echos the output. You can short circuit this process by just running update-binary directly from a root shell (you might want to run the "stop" command to stop android first). Eg, "update-binary 3 1 /sdcard/update.zip". (3 is the version number, 1 is stdout, and the zip file is whatever zip file you want the update-binary to install)
Note that this trick only bypasses the recovery signature check, there are still signature checks on bootup; all this does is lets you reflash individual (signed) pieces of stock roms.
There is no leak, at least not that we can use yet. Be assured though...there are ppl without jobs monitoring this 24/7. We'll find out about it if it's real. Kick back, relax and let those with too much free time do the work.