In jfrJavaSupport.cpp:

    static JavaThread* get_native(jobject thread) {
      ThreadsListHandle tlh;
      JavaThread* native_thread = NULL;
      (void)tlh.cv_internal_thread_to_JavaThread(thread, &native_thread, NULL);
      return native_thread;
    }

This code seems to return a native thread after the TLH that protects it returns so appears unsafe.