When you use a backslash to escape a regexp character in MySQL, you must also escape the backslash itself as \\. MySQL would see a single \ character and attempt to use it as an escaping character within the SQL statement itself rather than treating it as a literal. But you need it to act as a literal in order to modify the ? within the regex.
The first \ escapes the second \, resulting in a literal regex sequence \? to represent a single literal ? in the matching string.
MySQL documentation on string literals...
Format your expression with an escaped backslash as:
select *
from mytable
where thumbnail_url regexp '^\\?.+'