Is it possible to use Push Upgrades with packages not published to AppExchange? Maybe there is a way to pass the security rewiev and left package unpublished? Client's requirement is to use unauthorised (unpublished) packages and we are looking for a ways to provide updates to such package.
For both first- and second-generation managed packages, you must complete a Security Review to enable Push Upgrades and/or be listed on the AppExchange. As such, you can use Push Upgrades as long as you've passed the Security Review, regardless if you choose to list on the AppExchange. In addition, Unlocked Packages also support Push Upgrade, although these packages cannot even start a Security Review, and so cannot be listed on the AppExchange.