Yes, both scenarios are possible. The validity of a block is determined solely by its contents, not by when it is broadcast or received, so the attacker's longer chain is equally valid whether they broadcast it as they go, or all at once.
(There is an exception to this principle on testnet because of the 20-minute rule, but that's not relevant here.)
When a pool gives a miner data to mine it is not data for one specific block, but a template for a block. The miner hashes many variations of this block data to try to find a block that has a hash value below the current target (which is determined by the current difficulty).
To calculate the hash of a block on the blockchain given only the data that the ...