Here's code that should serve as an example on how to bypass this limitation using action hooks:
// the post this was sideloaded into is the attachments parent!
$p = get_post($att_id);
// add the function above to catch the attachments creation
// load the attachment from the URL
media_sideload_image($image_url, $post_id, $post_id);
// we have the Image now, and the function above will have fired too setting the thumbnail ID in the process, so lets remove the hook so we don't cause any more trouble
The premise is that when media_sideload_image is ran, it downloads the image, adds it as an attachment, then attaches that attachment post to the post whose ID you provided($post_id). Your issue is that it does not provide the newly created attachment posts ID, but, when an attachment is created, an action is fired containing that ID, and from that we can figure out the ID of the post (
$post_id), and set the featured image.