Can you modify the appexchange listing while the managed package is in security review?
Yes, you can. You should not modify the pricing (from free to paid, or the other way around), but you can add media, change the name, and so on.
What happens when you 'publish listing' before the package has passed the security review?
It is no longer a "private" listing and can be searched. The security review adds a special badge to your app that identifies it as security-reviewed, but does not affect your published status.
Are there any parts of the listing that gets locked once the review is in progress?
As far as I'm aware, no. You can continue to add media, change the description and pricing details, publish and unpublish your listing, and so on during the review process.
Can you continue developing your managed package and release newer release/beta versions of the package while the review is in progess?
Yes. The review process is against a particular version of your app. During the year window following a review, you can apply the security-reviewed flag to later versions of your code, but versions lower than the one submitted for review may not be automatically security-reviewed.