Do I need a heatsink for my voltage regulator?
That should be okay, in a TO-220 case with no heatsink, assuming moderate environmental temperature. 

You don't need to add junction to case to junction to ambient, all you need is junction to ambient, which should heat it to less than 48°C (assuming 25°C ambient). Remember, it's the temperature rise you are calculating. 

Too hot to touch is around 60°C, at least for my calibrated finger. If you're getting it too hot to touch there are several possibilities:

a) Your 200mA measurement is not accurate (perhaps the meter drops the voltage)

b) Your 7.2V measurement is not accurate 

c) You have really sensitive fingers 

d) It's really hot where you are testing it (30-40°C)

To answer your question about the maximum temperature and thermal shutdown- the data sheet specifies an abs. max. junction temperature of 150°C, but to be conservative I like to see no more than 100°C. That would imply a maximum ambient temperature of 75°C, which is reasonable. 

The actual thermal shutdown is kind of a last ditch thing, and does not come on until you've well exceeded the absolute maximum junction temperature, typically around Tj = 170°C. It's very unhealthy for the chip to experience this, but it does prevent immediate destruction. That would correspond to an ambient temperature of 145°C which seems mighty hot, even for southern Europe.