You have to realize that an instance of a class that extends Thread is not the same thing as an actual Java thread (which can be imagined as a "execution pointer" that runs through your code and executes it).
Instances of such a class represent a Java thread and allow to manipulate it (e.g. interrupt it), but apart from that they are just regular objects, and their members can be accessed from all threads that can get hold of a reference to the object (which is not hard).
Of course you can try to keep a member private and make sure that it's only used by the run() or methods called from it (public methods can be called from other threads as well), but this is error-prone and not really feasible for a more complex system where you don't want to keep data all in a Thread subclass (actually you're not supposed to subclass Thread, but to use Runnable instead).
ThreadLocal is a simple, flexible way to have per-thread data that cannot be accessed concurrently by other threads, without requiring great effort or design compromises.
