Explanation
The likely cause of this issue is that sales users profile does not have access to the remaining fields. Profile permissions determine what users can do with records, such as create, read, edit, or delete. If sales users profile does not have read permission for certain fields on the Invoice object, they will not be able to see those fields on the record detail page3. Page layout assigned to sales user profile, org-wide sharing settings, and role-based sharing are not likely causes of this issue.

Explanation
To help the system recover from a maintenance restart on Salesforce servers, the Salesforce feature that would help is enabling deferred sharing rule recalculation. This feature allows postponing the recalculation of sharing rules until a scheduled time, which can improve performance and avoid locking issues when there are frequent changes to sharing rules or role hierarchy5. Enabling granular locking or parallel sharing rule recalculation will not help, as they are related to improving performance and avoiding locking issues when recalculating sharing rules, not recovering from a maintenance restart. Enabling filter-based opportunity territory assignment will not help, as it is related to assigning opportunities to territories based on criteria, not recovering from a maintenance restart.

Explanation
According to this source, submitting to Force.com Security Scanner, using web application security tools, and using debug logs to check hijacked requests are some of the ways to make sure Visualforce pages are secure.
The other options are not sufficient or recommended.

How can an architect achieve this?
https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm
Example: To check the field-level read permission of the contact's email field before querying for this field:
if (Schema.sObjectType.Contact.fields.Email.isAccessible()) {
Contact c = [SELECT Email FROM Contact WHERE Id= :Id];
}
Answer for B -
https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm
The "with sharing" keyword allows you to specify that the sharing rules for the current user are considered for the class. You have to explicitly set this keyword for the class because Apex code runs in system context. In system context, Apex code has access to all objects and fields- object permissions, field-level security, sharing rules aren't applied for the current user. This strategy ensures that code doesn't fail to run because of hidden fields or objects for a user.