You do not need to conform with SLDS, although it is strongly recommended. From the Lightning Ready slide deck:
Do I have to re-style my app in order to be Lightning Ready?
No, but we do strongly encourage all partners to adopt the Salesforce Lightning Design System to be consistent with the Lightning Experience. This will provide a better experience for our shared customers and reduce cognitive load when switching between apps.
Note however, that being Lightning Ready is a requirement to begin a Security Review:
Lightning Readiness is a prerequisite for entering the Security Review process.
In other words, all of your Visualforce pages must work correctly in order to be valid for a Security Review. If it does something it should not, like display errors only in Lightning that do not occur in Classic, or otherwise fail to perform in a comparable manner in both systems, then it will not pass the Security Review.