We don't know that white hats can stop every bad thing the cabal tries to do with 100% effectiveness, so there's also option (3) that this was a black hat op that the white hats were unable to prevent (was not detected, or timeline of op was changed, etc).
Option (1) white hat op seems unlikely because all evidence is that the white hats are working to prevent damage to both innocents and cultural heritage. So I take black hat op as more likely … then the question becomes to what extent this was allowed to happen by white hats, or happened despite white hat preferences that it not happen.
Q may have it all (have intelligence records, etc) which matters from a disclosure and prosecution standpoint, but not be able to effectively act on or prevent 100% of threats in real time. And we have no idea how much of this shit is going on, that the cabal tries to pull.