On the Falcon 9 v1.0 that was used for the first 5 launches, they were down around the engine area, and required insulation and protection from the engines.
In the move to Falcon 9 v1.1 and the Merlin 1D engine they moved them into the LOX tanks on both stages. This de-cluttered the engine area a great deal.
COPV's are notoriously difficult to build, since they hold immense pressure (6000 psi in rocket use cases) and if they leak/burst/fail then they go off like bombs. With shrapnel.
SpaceX used to buy the COPV's from an external vendor but decided to bring manufacture in house. During development there was a failure of one of theirs, and it looked like minor bomb damage.
They have had flight delays due to issues with the Helium pressurization system on previous flights.
The current thinking floating around is not necessarily that one of the COPV failed (as in exploded very very violently as a 6000 psi vessel releases), but instead some component of them failed and leaked the Helium at a somewhat slower rate.
(I was cheering for the IDA breaking lose as the root cause but it looks like that has been ruled out. If it was the payload not the booster).