I just now got the time to write a thought through reply to this, I swear I've opened this one five times wanting to reply already...
For the music part it's a "you should do it but they can't really enforce it". Content ID only scans for sufficient matches in the content and not for description attributions. I'm 99% certain companies like NCS run content ID over their originally licensed stuff for tracking usage which isn't visible to others. However they a) don't have the tools and b) don't have the need to enforce this, especially not for Timmy with five subscribers putting it into his uncut 2 hour minecraft let's play in 144p without properly attributing it. I wouldn't worry too much about that.
The thumbnail stuff is where it gets really tricky. Just a few months ago I heard of an Austrian website getting charged quite a bit for using a background image they found on Google images, also my school had the same thing with a project a few years ago. For that while it's the same "You shouldn't do it but they 99.9% won't do anything about it" it's a bit more risky. As an attribution only saves your ass under very specific licences (e.g. CC-BY-SA) it also isn't the ticket in most cases. Fair use is the thing you could likely put most thumbnails behind though, unless you're copying the thumbnail 1:1 or just changing the background color you should be OK.
What we learn from this? Copyright is a party pooper but it doesn't affect many parties. (I'm bad at analogies)