The thing is, it was technically a correct report. One frame of that gif did correpond to a known piece of CSAM (presumably they use some kind of perceptual hashing). The facts that 1) the gif was clearly a sick joke (he described it as a slow motion bullet shot from a movie, landing in something/someone and then flashing the one frame, presumably the intention being "haha, get shot with the child porn bullet"); 2) it was only one inconsequential piece, not a whole collection; 3) it was downloaded automatically from a group chat... are not in scope of the "did this user just upload CSAM to our servers" function (from what I understood, it was triggered by the picture being backed up to Google Photos or Apple's equivalent).

These are all things that, in a functioning system, the police officer receiving the report would take into account. If it's a first report, diaregard. If it's a second, check the file name that was also presumably in the report, see it's a Whatsapp folder and disregard it. If it's a third report or there are multiple pieces, get a warrant to run a CSAM scan on the person's device, go to their apartment, run it, see there's nothing else, close the case. If it's a clear "prank", start investigating the person who sent it.

But since the police are, in general, trigger happy lunatics, you get a full raid instead. And since computer forensics is hard and doesn't pay well, the investigation took many months instead of an afternoon. The fuckup was squarely on the law enforcement side, as well as in the law itself.