FTP in general is not really safe. And since you'll have the account data somewhere in your project, there's nothing like safety.
One thing you can do is having a user setup which is only allowed to read (download) files, and only has access to a single folder (maybe + subfolders) where you put all the download stuff.
If someone messes with that account, you'll get more download traffic, but you don't have to fear about unwanted upload/deletions.
-> never give away your "administrator" account

Maybe you can even get some server only responsible for providing downloadable stuff, so in case something happens with it, nothing else is affected.

I'm pretty sure justsid can tell you more about security issues, what I wrote is the bare minimum you can and should do.

Concerning the default folder: it usually is www - for web stuff. But this is not required, it can be anything. Basically you should use a ftp client and log in first, then see where you start - which you usually anyway do when you upload the file for later download. From there on you can trace the full required path. Just taking the web address and replacing http:// with ftp:// will not work, as your www-domain normally does not point to the ftp user's home directory.