Thumbnail errors were just being used in `selectThumbnail`. The form doesn't know about it and was using allowing invalid thumbnails like 'helloworld' to pass through.
I believe the rest of the GUI is setting 'thumbnail'.
'thumbnail_url' is only populated right before publishing.
So, the flag was always false -- we just never see the error on screen because the component is incorrectly hidden (fix for this is coming up next...)
