I got an unmanaged package from the developer. I installed it in the developer org. Created a managed package from the components and gave the managed package for security review.
Here is the message that I got:
The test org provided has the wrong version installed (You submitted version 1.0 but provided version 1.1). Confirm the correct version's installation for testing or otherwise submit the correct version in full.
The test org provided has an unmanaged package installed; you must submit a managed package for security review.