This week's book giveaway is in the OCPJP forum. We're giving away four copies of OCA/OCP Java SE 7 Programmer I & II Study Guide and have Kathy Sierra & Bert Bates on-line! See this thread for details.
There are a few reasons -- but if I had to guess, I would say that security is probably a big one.
Imagine an applet trying to open a network connection. Applets, by default, can only go back to the originating source. So, when an applet tries to open a connection, the host is passed to the security manager for approval prior to opening the connection. If the String class weren't final, you can override the class to behave a certain way during the security check, and behave in another later.