I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating Push Upgrade and Patch Management.
Not being able to provide patches and at the same time having to prepare for Security Review puts ISV partners in some kind of technical Deadlock. Here is why:
You need to support your paying subscribers. In case of bugs, contractual SLA require you to fix in the form of Patches. So you need Patches.
You can't use the latest version for that because
- Not all customers are on the last version and also cannot be forced to
- If you use Main for Fixes then you cannot put your fixes there that you do for Security review. For submitting for Security review you need to provide a Package scan from the Packaging org.