To list an app publicly on AppExchange, the app must pass a security review. If a managed package passes the review, any custom apps, tabs, and objects it uses won’t count against the related limits in a customer’s organisation. Additionally, a managed package that passes the review will not count against the contractual license limits of a customer’s organisation. However, other limits — such as limits to the number of custom fields on an object — still apply. If the package is unmanaged, any resources it uses will count against the related limits in a customer's organisation, regardless of whether it passes the security review.