Generally, the question stands as what steps need to be done in order to send 2-nd generation managed package for security review.
I have developed 2-nd generation managed package on standalone dev org.
After that client has created their partner salesforce account and linked both namespace and developer dev orgs to that partner account.
Am I missing something? Is it possible to publish 2-nd generation managed package for security review? If no, what do I need to do in order to send it to security review ?
Update. Winter '20 made Second Generation Managed Packages GA. Go ahead and publish them!