Can cookies safely be stored in the public filesystem (sites/default/files)? One of my modules does some CURLing, and to do this it creates a cookie on the Drupal server. Where should I locate this? Where it will be nice and safe? Is there a convention? Is sites/default/files considered safe?
The risk depends on the nature of the cookie. If these cookies contain session data, they could be used to take over you session, which is considered to be high risk. 

Your public files folder (sites/default/files) has public read access, meaning that everybody can obtain a file (once they know its name) by going to example.com/sites/default/files/[FILENAME]. This is not safe and perhaps not the best solution for the type of cookies described above.

Instead, you can save it to the private filesystem. Instructions for Drupal 7 and 8 differ, so best to look up the instructions you need. The ultimate safe solution would be to move your private filesystem outside of your webroot (some tutorials create it as subfolder of sites/default/files). Safer would be to place it in a folder next to your public_html/www folder or anywhere else on the filesystem, where it is not accessible from the internet.

If you configure it properly on SITE/admin/config/media/file-system, you can then use the streamwrapper private:// to read and write the files.

If these cookies do not contain any data that could be considered to be sensitive, sites/default/files (or public://) should be good enough.