1) That sounds correct. You can just use the sd2snes folder that was extracted from the downloaded zip file, put all the BIOS files in it, then copy it to the root of the SD card. Don't mix files from different firmware versions, they should all come from the same zip archive (except for the BIOS files, save files and cheat files). Nothing in the SD2SNES is updated AFAIK though, it uses the files in the sd2snes folder every time you start, so you can't delete any files. The save and cheat folders are not in the downloaded sd2snes folder but will be created by the SD2SNES the first time you use it.
When you update the firmware you have to copy your save files and cheat files (if you have any) folders to you computer, delete the sd2snes folder on the SD card, unzip the new firmware version (on your computer), copy all your BIOS files and save and cheat folders to the new sd2snes folder then copy this new folder to the SD card root.
It's also a good idea to make backups of your save files to your computer from time to time (and zip them) in case your SD card goes bad.
2) Yes you can have rom files anywhere you want, and it's best to have them in their own folder (or several folders) in the root, separate from the sd2snes folder. If you have a lot of roms you can also have several sub folders where you divide them in alphabetical order or sorted after genre etc. You can also have a separate folder for spc files in the root (or anywhere you want).
Yes you need to unzip all roms and spc files before you copy them to the SD card. The SD2SNES can't extract zip files. Always unzip on the computer before copying any files to the SD card, don't unzip directly to the SD card (not sure if it really matters but that's what I've heard). If you have a lot of roms this can take a while.
