In full-disk encryption you usually have a key hierarchy. A Key Encryption Key (KEK) is derived from a user password, as you stated often this is done using PBKDF2 (alternatively nowadays more preferred is scrypt). The KEK then is used to encrypt the Disk Encryption Key (DEK) which is actually used to encrypt the storage media.
I am not entirely sure if TrueCrypt really uses the password derived key to encrypt the disk. However, coming to your first question: Where exactly are these random keys stored? Every FDE solution has one tiny part of the disk which is not encrypted and where the DEK is stored in a secure manner (encrypted, see process above). This is the reason why attacks such as the Evil-Maid can work. On boot, the system needs to start a minimal environment which prompts the user for his password, derive the KEK and decrypt the DEK. It then checks whether the DEK is actually correct (probably by decrypting a fixed known pattern). If so, the disk decryption starts and the system continues its boot procedure.
Your next question: Why are random keys used for FDE? Imagine you don't use random keys and instead a fixed-pattern-key that for example is time based. An attacker only has to identify the appropriate setup time and can reduce the amount of keys to brute-force largely!
If someone is able to get the password, the hacker would get the cipher key anyway.
That is true, this is why we need strong passwords, strong cryptographic primitives to derive the keys from them and strong keys that encrypt the disk. The first two are essentially to make brute-forcing the KEK take as long as possible. An attacker will eventually be successful, after all it's a brute-force. However, we want him to not even try because it would take far too long and the information stored on it by then probably outdated and worthless. Alternatively we include penalizing actions, i.e. an increasing timeout on false password entry, or a forced wipe after a specific number of tries.
The key encrypting the media must be random and hard to brute-force, as otherwise an attacker could easily target that key instead of the KEK derivation process that is designed to be slow.