I get prompted even with the SD card removed so that leads me to believe that it isn't on the SD card. Since I have e-shop titles, my plan is to wait for the Red-NAND feature, copy the NAND and update the redirected NAND, and then format the original to wipe the update while keeping my eshop games VIA Red-NANAD.
I've been wondering about something. There's an option in "Nintendo 3DS Camera" to copy a picture from the SD Card to the device. This leads me to believe there's storage in the 3DS. It would have been hilarious filling this up with pictures, so that no update would save itself there.