Where does Apple App Store download security updates to?
First off: did you consider "Content Caching" in High Sierra's System Preferences > Sharing?

But to answer your question: while downloading you'll usually find the files in the system caches in the... 

/private/var/folders/zz/


...folders (owned by _softwareupdate or/and _nsurlsession, with no access to the user).  But that's just a temporary state and they usually get assembled in numbered directories into...

/Library/Updates/


Since updates consist of more packages these days, they refuse to run individually and the .dist file will have to be opened with the Installer.app to install them in order.

The packages will wait for installation, before being removed, so making sure System Preferences > App Store is set to not automatically update and clicking "Not Now" before the download, or "Later" in the installation window will postpone installation and therefore removal.