The three reasons user A has access but user B is unable to access the record are:
User A is on the same account team as user C. Account teams are groups of users who work together on an account. Users who are on an account team can have access to the account and related records owned by other team members.
User C has manually shared the record with user A. Manual sharing is a way of granting access to individual users or groups by the record owner or someone above them in the role hierarchy.
User A is in a public group that has access via a sharing rule. Public groups are groups of users who can be used to share data or assign permissions. Sharing rules are automatic rules that grant access to groups of users based on certain criteria. Option B and D are not reasons for user A's access.

Create a page layout with the field and use field-level security to hide the field from all other users is how the app builder should meet the requirement of making the comment field on Review private to anyone outside of HR department. Field-level security can control which profiles can view or edit a field on a record. Create an Apex sharing rule, create a sharing rule to share the field with VP of HR with Role and Subordinates, and create a page layout with the field for HR users and another page layout without the field for all other users are not valid or feasible solutions for this requirement.

The category that handles bug fixes and simple changes is minor. A minor release is a type of release that introduces small enhancements or fixes to existing functionality, such as correcting spelling errors or improving performance. A minor release usually has a low impact on users and does not require extensive testing or training. A patch release is a type of release that addresses critical issues or defects that affect the functionality or security of an application, such as fixing broken links or resolving vulnerabilities. A patch release usually has a high impact on users and requires immediate deployment. A major release is a type of release that introduces new functionality or features to an application, such as adding new objects or components or changing business processes. A major release usually has a high impact on users and requires extensive testing and training. A rollback is not a type of release, but an action that reverses a release that has been deployed to an environment, such as undoing changes or restoring previous versions. A rollback may be necessary if a release causes errors or issues that affect the functionality or performance of an application.