This week's book giveaway is in the OCAJP 8 forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide and have Edward Finegan & Robert Liguori on-line! See this thread for details.
There are a few reasons -- but if I had to guess, I would say that security is probably a big one.
Imagine an applet trying to open a network connection. Applets, by default, can only go back to the originating source. So, when an applet tries to open a connection, the host is passed to the security manager for approval prior to opening the connection. If the String class weren't final, you can override the class to behave a certain way during the security check, and behave in another later.