Sorry if this has been asked. But what happens when you have a profile that is applied to all devices using a device tag and later you add a user tag, which includes the same devices and then you remove the device tag.
Another way to look at is that the device itself does not know what tags it has... only the MDM does. The MDM thus decides when to send commands to the device. It doesn't matter how a device is scoped to receive a profile (user tag / device tag / etc.) as long as that device continues to be in the scope of the profile.
If you removed the device tag first, and then added the user tag to the scope of the profile (and pressed "Save" in between) then you would be taking one step to remove the profile and then another to add it back on.
Thanks for the clarification. That's how I hoped it would work as the settings in the profile control internet settings and if the profile were to be removed I was worried it would struggle getting the settings back due to no internet access