Can a Reentrancy Attack Be Performed without a Fallback Function?

Yes, a reentrancy attack can be performed without a fallback function. Any external call from one contract to another can be a vector for reentrancy.

For example, if a contract calls a function on an external contract that the attacker controls, that function can be programmed to call back into the original contract. The vulnerability is not the fallback function itself, but the act of making an external call before updating state.

The fallback function is just a common and convenient way to trigger the re-entry when Ether is sent.