The LMA doesn't support unlocked packages. Managed packages only.
"Being in the AppExchange" can mean a number of different things. To link your package to the LMA, you must have your package available in the Publishing Console in the Partner Community, which means you must be a registered partner and link your namespace org. Your package does not have to be listed publicly on the AppExchange in order to use the LMA; you can have a private listing for the package.
I am not certain whether or not you can use the LMA without passing Security Review. However, you should plan to pass Security Review anyway, as it provides assurance to your customers and comes with the nice side effect of providing your package with a set of namespace-scoped limits to help ensure it doesn't impact performance in customers' orgs.