Your question seems muddled due to mixed up terminology.
Here are what the words actually mean:
Hardware UART: There is a dedicated peripheral in a controller that contains dedicated register and timing circuits to manage the UART. Management includes things such storing incoming UART bits into a receive buffer register, sending outgoing bits from a transmit buffer register, as well as flow control. In other words, the central processing unit in the controller does not have to manually manage each and every individual bit and control line.
Software UART: A software UART is bit-banging which means it just uses the general purpose I/O and having the central processing unit in the controller run code to emulate a UART by manually toggling the I/O lines to produce outgoing bits and reading incoming bits based on a timer.
Neither of these precludes the presence of a controller. In fact, they both necessitate the use of a controller.
So this bolded part of your question is irrelevant:
Is it in a hardware UART, a soft UART, or by the PC the USB is plugged into (very unlikely).
But then you say this:
I'm thinking I've heard the chip has a very fast processor inside to implement the serial protocol and it can even receive downloads over the USB port. I know their chips can work in many modes, SPI, I2C, JTAG, etc. I'm thinking this is not all hardware.
So, instead, it sounds like what you're really asking is:
Is it in there an onboard controller driving lines or by the PC the USB is plugged into (very unlikely).
And the answer is that there is an onboard controller. The FTDI-USB bridge contains a controller sitting between a USB-transceiver and an RS-422/485 transceiver. The controller is required because USB packets and the UART signals upon which RS-422/485 are based are not 1:1 compatible. Therefore, something needs to packetize the incoming UART bits into USB packets to send to the PC, as well as depacketize and interpret the USB packets from the PC to know what UART bits to send out.
Obviously more data can be passed through these USB packets than just the incoming and outgoing UART bits. These things include the baud rate that the USB-UART bridge should be using, whether flow control or handshaking should be used, what kind of flow control should be used, and the states that outgoing control lines should be placed into, and the state being read for incoming control lines (such as RTS and CTS).
Whether this onboard controller is driving the UART lines via bit-banging with a dedicated UART peripheral is irrelevant to us as outside users. As a commercial product in ASIC form, I would expect the FTDI USB-UART bridge to be using dedicated peripherals for its UART, JTAG, SPI, and I2C interfaces rather than bit-banging. It's just silly not to do so.