MySQL/MariaDB AES_ENCRYPT() - ECB mode, IV, Padding Oracle Attack Question
No
No
If the attacker doesn't steal the key, they can't create their own padding oracle.
As long as the key is not stolen, no mitigation is required.


Your threat model for "someone [having] stolen the database contents" seems very weak: if you make a query containing the decryption key, the key bytes themselves will likely persist in memory long after the query has been executed. See this recent paper for a discussion of realistic threat models for database compromise. (Full disclosure: I am a co-author of the paper.)