I've gone through a resubmission last year. To be fair, the process was fairly straightforward (exactly the same as a normal submission) - but that's because I kept the resubmission in mind after my initial release.
To answer your questions:
Reviewing old code that hasn't been touched in years. It's easy to prepare when you remember the entire application in your head - less so when you wrote something 2 years ago and never looked at it since.
Definitely less work than my initial submission. I relied primarily on the
code scanner report to focus my attention. With that being said, there were some issues that I detected (that the review team did not, btw) that were not found in the code scanner.
I only submitted an architectural document, without a user guide. I did provide testing instructions in the submission though, and hints and tips in the app data (click me, drag me, right-click me, etc).
Their scans are detailed. If you have anything on Heroku, you MUST use a CDN to comply with all the requirements. It costs additional money per month, but that's the only way I was able to comply with all their security requirements. I failed one review because I gave a different error message when trying to log in with a wrong password as opposed to with a username that doesn't exist. This, they rightly said, can be used to farm email addresses.
Another recommendation, if you're using express on Heroku, is to use Helmet and some security-related headers. Here's what I ended up using:
res.set('Access-Control-Allow-Origin', 'https:// .isimio.com');
res.set("Content-Security-Policy", "default-src 'self'; frame-ancestors 'none'; form-action 'self';");
res.set("Cache-Control", "no-cache, no-store, must-revalidate");
- I haven't done this, but it probably won't hurt - especially if you haven't gone through a security review yourself before.