There are a few reasons -- but if I had to guess, I would say that security is probably a big one.
Imagine an applet trying to open a network connection. Applets, by default, can only go back to the originating source. So, when an applet tries to open a connection, the host is passed to the security manager for approval prior to opening the connection. If the String class weren't final, you can override the class to behave a certain way during the security check, and behave in another later.