Flash custom firmware
In theory you can flash custom firmware and unlock device using patched firmware. If you read instructions to modify firmware it looks like it should works.
Alternative ways to crash iOS activation screen
As you already know Apple have been patched exploit that used by iCloud DNS Bypass. There was many devices with owner information on lock screen. This devices can be unlocked until reboot using Application -> Crash method. Since it no longer works, here is alternative ways to crash Activation page.
Skip iOS Activation Pages
I have found glitch that allow to remove iOS Activation pages and skip them. It is not bypass, but way to find more bugs.
Best step to get removed
First of all need to understand that iCloud Lock it just device link to exact Apple ID. And once Apple ID owner remove his device from iCloud account, it immediately become unlocked. This makes you understand that the best and easiest way to remove iCloud Lock is contacting with owner, and ask him to remove device from his account.
Fake paid unlock services
In Internet there is a lot of scammers, but there is also people who really can unlock iCloud for high price. But there is some kind of scammers that mask themselves as good unlocking service. I'll give you example to better understanding how they are doing that so you will understand and do not be scammed.