So we know a controller in Drupal 8 is a class placed in a specific directory structure that is used as a page callback, as in it is a function that reads from the request object and returns a response - it displays a custom page. But what are thin controllers? I thought it was all about the base these days!
In Drupal 8, you want your controllers to be thin, and that basically means you want it to be as light as possible with all the heavy lifting to be done via services. In other words, you want to keep the logic in your controllers to the minimum. If you need to create a lot of functionality to display a page then you're better off placing that into a class and registering it as a service with the service container and you can then use that service within the controller.
So best practice when it comes to controllers is keep the logic inside them to a minimum. It's only job is to construct and return a response. Any heavy lifting should be offloaded to services. This post explains it quite well.