The verification key is referred to as public. Could it be derived from the bech32 address? e.g addr1... -> Pubkey [cborHex]
No, the public key (also verification key) cannot be derived from a bech32 address. Only the hash of the public key is encoded in the address.
The verification key is secret as long as it is not used to spend some value from one of the corresponding addresses. When such a transaction is onchain, then you can extract the public key from it (1)(2).
As Fermat said, the Bech32 address only contains the PubKey Hash, and therefore we can't reverse it to obtain the PubKey.
The purpose of PubKey is to act as Verify Key, that will verify the authenticity of a signed transaction with its signature
You can refer to this video by Andrew, it will explain how addresses work in Cardano
Video: Cardano Addresses