When I update my offering, do I need to pay the security review fee again to have it reviewed?

No. When you upload a new package version to the AppExchange and associate it with your listing, we run a source code analysis to identify security vulnerabilities. This scan is included in the annual listing fee, so there is no extra charge. However, you are asked to confirm your payment information when you run the security review wizard.