we cannot instantiate java.io.FilterInputStream as it has no public constructor, we even don't need to without extending it.
why didn't they make that an abstract class?
Technically protected in Java includes both subclasses of the class in question, and other classes (not necessarily subclasses) that are in the same package. So it would be possible for another class in java.io to directly instantiate a FilterInputStream. The only reason I can think for why you'd want to do that is that FilterInputStream.read(byte[] b) delegates to this.read(b, 0, b.length) rather than delegate.read(b) so it's a way to prevent the delegate's read(byte[]) method from ever getting called. But that's all speculation on my part.
Other than that specific case, as you note it is effectively abstract, but it doesn't have any abstract methods so the compiler would not require that the class be declared abstract.