Imagine A gives permission to B to transfer tokenId==111. That is, _tokenApprovals=B. B executes transferFrom and sends the token to himself. Later, through some exchange for example, B sells the token 111 to another person, without having modified _tokenApprovals. Couldn't he send the token to himself again, because _tokenApprovals is still equal to B?
That's exactly why in the transfer() method they clear approvals. Which does reset _tokenApprovals.
// Clear approvals from the previous owner _approve(address(0), tokenId);