All AppExchange products are subject to Salesforce security reviews.

The correct selection is B. Failure to enforce object CRUD and field-level security is a recurring AppExchange security-review problem because packaged Apex must respect subscriber authorization. Secure designs explicitly enforce user access rather than assuming UI configuration alone protects records and fields. From a build perspective, the implementation should be source-driven, reviewable, automatable, and modular. Engineering controls such as version control, package boundaries, static analysis, coding standards, and isolated development environments reduce defects early and make changes easier to understand, test, and promote. The alternatives do not create the same repeatable engineering control: they either postpone defect detection, couple teams unnecessarily, or bypass the package/source model that should govern the change. For this scenario, the decisive point is therefore the platform behavior represented by the selected option (B. CRUD/FLS (field level security)). Applying that rule consistently keeps the implementation aligned with Salesforce-supported lifecycle practices and makes the resulting change easier to review, validate, and operate across environments.

Study Guide reference: Building — Salesforce DX; package development; coding standards; static analysis; source control; secure development.