Why don't those appear in my own Checkmarx / Security Scanner runs?
Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug with someone. Also, the SFDX Security Scanner is a suite of tools, but not necessarily as comprehensive as Checkmarx, and may also be out of date. Make sure all your packages are up to date if using the Security Scanner.
Why don't those appear in the Sec Review Checklist documented in https://partners.salesforce.com/0693A000007QbpbQAC?
I apparently can't access this, but the Security Review Submission Requirements Checklist Builder seems like the best option. Note that it asks for details about the project to filter out irrelevant rules.
Is there a complete and up-to-date list of everything that Salesforce is checking?
Yes (see the Builder).
Is there a way for ISVs to automatically check those rules BEFORE going into a SecRev?
What about Apex PMD, perhaps with custom Rules? In reality, I suspect that PMD is probably missing these because it doesn't scan non-Apex resources. The Checkmarx scanner should work, though, and again, I'd suggest logging a bug. Since Checkmarx is the official scanner for a Security Review, that's what you should be using. If you're paying for Checkmarx, see if there's an updated version you should be using by contacting their support team.