It's up to you whether it is better to duplicate fields 1 - 4 or not. That depends on your specific requirements, what the fields are, etc.
In my experience I generally go with A (1, 2, 3, 4), B (5, 6, 7, 8, 9) and the fields are usually logically grouped into each profile.
For example there might be 2 profiles like "Personal information" and "Employment information" or something like that, which obviously will have their own different grouping of fields, but I can see there may be cases where you might want to go the other way.
One annoyance that you might have to deal with if replicating fields is that when a user switches types they have to enter information into fields they already filled out in the other profile. That would annoy me as a user. You could work around that though and auto fill the fields.
Either way, you can control access to different profile types based on user role.
So the easiest solution would be to configure a role for each of the profiles and then have an administrator add/remove the roles from users as required.
If your use case allows for it there are also modules that allow users to change their own roles (you can limit it to specific roles so they can't make themselves an admin), for example role delegation. This might be appropriate for some websites. Just make sure they can't give themselves any dangerous permissions.
