Earlier quoted context omitted.
>> they would start to experience problems, like seeing eachothers data and stuff. Wait, what? I'm going to need some explanation or story time about how this happened.
It's not that uncommon in some languages where you have a long running monolith (.NET, Java, etc) instead of an instance of something that spins up per request (Node, PHP, etc). If someone does something silly like setting the session handler to be scoped to the monolith app rather than having a scope of a single request you end up with users seeing one another's data. It's dangerously easy to do in some frameworks.
Plus you didn't even need to multi thread in old school asp.net, IIS would create a new process for every request back in the day.
.Net did have a notorious 'session' object, which was the cause of a lot of problems due to novice/offshore programmers, but not the symptoms described above.
I'm not sure why you've targeted monoliths and .net/java, but the problems described above are usually caused by multi-thread/shared variables, which weren't a common thing to do in asp.net. You'd really have to go out of your way. I've seen some terrible .net code written by novices or poorly trained offshorers, but nothing like that.
I'd be more likely to bet they rolled their own cookie or session management or jwt token manager, and I'd guess it was an early js/nodejs app before that ecosystem stabilized when people were raving about going framework free and then footgunning themselves.