(but bear in mind I come from a Mercurial background so maybe I'm not fully understanding Git's branches - I think they exist outside the version control somehow?).
Git branches work like Mercurial's bookmarks. They're not immutably attached to commits but act as flexible pointers to some commit ID (see Mercurial's Bookmarks docs), so it is entirely possible for several repositories to have their own bookmarks pointing to the same commit.
(In fact, that's what happens when you push to GitHub – first the commits are uploaded, and then the remote repository's "main" or "master" bookmark (i.e. branch) is updated to point to them, so now both the local and remote bookmarks independently point to the same commit. And similarly, when you create a new local branch off "master", it's just creating a second bookmark that points to the same commit as "master".
Though it seems that Git branches aren't kept as strictly in sync with the remote repository as Hg bookmarks are. Diverging is expected, so the branches downloaded from a remote repository are always namespaced with "reponame/", while Hg's docs imply that a diverged "foo@reponame" bookmark is supposed to be dealt with quickly.)
How is it possible that I could switch to a branch on the upstream repo if I'm working on a fork?
You're not only working on a fork; you're working on a fork of the fork. The cloned repository that you have on your desktop is fully separate from the fork that you have on GitHub – it has its own branches and everything. (Neither the "origin/" branches nor "upstream/" ones are actually local to the repo that GH Desktop is showing; they're only locally cached copies of remote branches.)
Git repositories aren't limited to having a single URL to push/pull from – it is very common to have two when working with forks, and to directly fetch commits and branches from both. For example, you might integrate the newest upstream changes by merging "upstream/3.x" into your local "3.x", then push to your GitHub fork's "origin/3.x".
If the upstream repo has some commits ahead of my fork on the 3.x branch and I click on upstream/3.x, does my working directory somehow gain the changes from those upstream commits?
Yes, it does. Your desktop repo has full copies of all branches from the upstream repo (as of the last fetch) and you can check out their commits, create local branches off them, merge or cherry-pick individual commits into a local branch, etc. (This is more general than just "upstream", you can configure any number of remotes, e.g. to track someone else's development fork.)
However, at least using the command-line git tools, checking out a remote branch (whether it's "origin/3.x" or "upstream/3.x") is a temporary operation – it doesn't automatically create a local branch that you can work on, it only checks out a "detached" commit. You can still create a branch off it, it's just not automatic.
(Though if you try to check out a non-existent local "3.x" branch, Git magically creates it from "origin/3.x".)
I haven't used GitHub Desktop for a very long time, so I don't know exactly what happens if you check out a remote branch through the GUI – it may offer to create a local branch "3.x" named after the remote one, or it might not.
