Where are backups stored?
The guide you are referring to assumes that you will be tracking your website as a git project. This is the best way to develop locally before deploying on the server.

The workflow for that is to use composer create-project, then initializing the git repository and adding everything. The default .gitignore should ensure that the installed code isn't added. However, the scaffolding files like index.php and autoload.php are. Once that is done, you can deploy the site on any server by cloning the repository and running composer install.

When the guide says that after updating you should 


  Run git diff to determine if any of the scaffolding files have changed. Review the files for any changes and restore any customizations to .htaccess or robots.txt.


it means that updating may have replaced these files, and you may need to re-add custom changes and then commit the new files to git.

composer doesn't create any "backups" when overwriting the scaffolding files - this is why it is important to track the scaffolding files in git, especially if you have custom modifications.