Some of us are accustomed to the legal UK/EU protection for such delay with right of care and €600 compensation.

Unfortunately CX is a foreign airline flying into UK/EU so that regulation does not apply. It would to BA or European airlines.

Hard to see how hotel could have been provided. According to the OP, pax started to deplane 3h hours later (so 3am or later). CX was looking for a short-term solution so cannot organize transfer to and from airport of so many pax. Instead they kept the lounges open.
The problem with the current war and QR/EK/EY limited flights is that CX flights to LHR are heavily booked, and only one other CX flight in the morning.