Plus you didn't even need to multi thread in old school asp.net, IIS would create a new process for every request back in the day.
.Net did have a notorious 'session' object, which was the cause of a lot of problems due to novice/offshore programmers, but not the symptoms described above.
I'm not sure why you've targeted monoliths and .net/java, but the problems described above are usually caused by multi-thread/shared variables, which weren't a common thing to do in asp.net. You'd really have to go out of your way. I've seen some terrible .net code written by novices or poorly trained offshorers, but nothing like that.
I'd be more likely to bet they rolled their own cookie or session management or jwt token manager, and I'd guess it was an early js/nodejs app before that ecosystem stabilized when people were raving about going framework free and then footgunning themselves.
I checked, node existed but it was a toy compared to jsf.
It’s sufficient to simply use the “static” keyword or a singleton service that should be scoped to the session.
The sad thing is that the default is the happy path, you have to go out of your way to break the session scoping by “being too clever”.