When I download PGP keys from keyservers like so:
gpg --search-keys firstname.lastname@example.org
How are the public keys transferred down to my machine? Is there a possibility of a MITM attack to serve me the wrong key?
If you use the signatures on the key to validate it (such as the web of trust model), then you only depend on the key material you have, and not the key served to you. In fact, if you know the fingerprint of the key you want (with certainty) you can just verify the fingerprint after retrieving it.
If you want to avoid a MITM, you can use the hkps protocol described on the SKS Keyserver page here: https://sks-keyservers.net/overview-of-pools.php.
Keep in mind that anyone can upload any key to the keyserver, so just because it has the email you want doesn't mean it's the right key. Only the signatures on the key (and the trustworthiness of the signatures) can help determine if the key you have is the legitimate one.