JVMS 4.7.6 provides the interpretation of 'inner_class_access_flags' in a table, 4.7.6-A. Many interpretations mimic ACC_PUBLIC:
"Marked or implicitly public in source."
But ACC_FINAL does not acknowledge that some classes may be implicitly 'final':
"Marked final in source."
This is almost certainly an oversight -- the only implicitly-final classes are anonymous classes, per JLS 15.9.5. But they exist, and there's not a good reason to prohibit them from being marked as such in the 'inner_class_access_flags' attribute.
Note that the class's 'access_flags', JVMS 4.1 (table 4.1-A), doesn't bother with this "marked" vs. "implicitly" distinction, because it is not concerned with Java sources. Instead, it uses "declared" in the sense that the class file itself declares properties: e.g., "declared synthetic".