If I update my application, do I need to pay the security review fee again to have it reviewed?

No. The security review is a periodic, point-in-time review at an interval determined by salesforce.com (typically anywhere between 6 months - 2 years). When you upload a new package version to the AppExchange and attempt to associate it with your listing, we automatically run a source code analysis against your Force.com code to identify potential security vulnerabilities. If we identify any issues, we’ll send you a report via email and request you to address the issues immediately. We reserve the right to conduct random security penetration tests on your application throughout the year. This is covered within the listing fee that you pay annually and there is no extra charge. However, if we find that you’ve deviated from our security standards and best practices we may remove your application from the AppExchange.