You could, but that would change the behaviour of existing programs. It might well be that there are well-defined programs out there that use strtok across separate, but properly synchronized, threads.

This is why it's crucial to get APIs right first time.

Yes, as long as you can guarantee that there’s only one tokenization going on per thread at a time.