You have correctly identified the primary threat, which is social engineering. The image prompts the user to view what they believe is a harmless video, they're misdirected into a phishing scam.
There is another interesting threat I believe you've outlined quite well: an attacker crafts the contents of a website so that when processed by a thumbnail generator, the resulting image can cause arbitrary remote code execution on the end-user's device. While this attack sounds very interesting, and might be plausible, I would imagine that an attacker would be more interested in remote code execution on the Messenger platform. The thumbnail generating parser may be vulnerable to remote code execution on Messenger's servers. Even if the user does not engage the link/preview, the existence of this preview functionality increases the attack surface for malicious software. Should the thumbnail generating service be compromised, it follows that an attacker may then be able to provide arbitrary thumbnails, perhaps even arbitrary responses in the Messenger service. In other words, the presence of the feature puts Messenger at risk and therefore it puts end-users at risk.
As for the possibility of fuzzing the thumbnail generator or causing the generator to pass remote code execution exploitation within the image served by Messenger? I can imagine that it is a possibility, but I'm not certain. It seems to me that this would be computationally intensive, require privileged information about the thumbnail generator, and is an attack that would be very easy to spot in the wild. If I were threat modelling for the security considerations of installing the Messenger app, this particular attack would be lower priority.
