What is the security risk of implementing password hashing using SHA-256 without a salt?

• A.SHA-256 without salt is vulnerable to rainbow table attacks (precomputed hash databases covering millions of common passwords), and identical passwords produce identical hashes (allowing an attacker to see that multiple users share a password by seeing the same hash). A salt (random unique value per user) ensures identical passwords produce different hashes, defeating rainbow tables
• B.The lack of salt only matters if the attacker can see multiple hashed passwords simultaneously
• C.SHA-256 without salt is secure because SHA-256 is a one-way function; reversing it is computationally impossible; hashing the username together with the password removes the need for a salt, since usernames are unique per site; password hashing must be reversible for support staff to read the original during recovery, which is why AES beats bcrypt; credential stuffing is brute force against one account, while spraying one password across many accounts is a dictionary attack