Can the required profile form be bypassed by changing the URL or reloading?

No. The current logic is designed to work in a fail-closed mode and prevent the required profile step from being skipped through reloads, back navigation or URL manipulation.