Consider a research work that is present in another person's thesis, submitted two years before at the university, but not published online anywhere. Can someone extend that work and submit it to a journal?
You can work on anything you want. If you publish you must:
cite the thesis;
give an accurate account of what work was already contained in the thesis, and what you added;
if you use passages of text or images taken directly from the thesis, identify them as such (as a quotation or similar). Extensive use of such quotations or images may also require permission from the original author and/or their university, depending on who holds the copyright.
The situation that you describe perfectly matches the situation fifty years ago, when nothing was published online. Now, just as then, it is entirely possible for somebody who wants to find the thesis to go to the university and look it up, or otherwise request access to the original. It is just that now, our expectations have been raised by the ready electronic availability of material.
Thus, the situation with regards to plagiarism is the same as it has always been:
- You can build on any intellectual work that has been created.
- You must properly cite any work that you have built on.
- You cannot claim the work of another person as your own.
That the thesis was not published online is not relevant. You can conduct follow-up research, just like you can write a follow-up to anything somebody else has published. However, you most certainly cannot pretend that something originating from this thesis is actually your work. Just that the results have not been published in a peer reviewed venue does not make the results somehow "free lunch" for somebody else to claim.
It does not matter whether the work can be found online or not. From the plagiarism tag wiki:
Plagiarism is the unethical practice of taking credit for someone else’s work. It is a major concern both in research, where the most common issue is improper use of citations (or lack thereof), and in coursework assignments.
Self-plagiarism refers to reusing one's own previously published work (or previously used coursework), without properly citing it as such.
So if you use previous work, whether available online or not, whether it's your own or someone else's work, cite it appropriately.
It is expected that any resource you use in your paper, whether published or unpublished, should be cited. For unpublished data, most journals would also expect you to take permission from the author.
Here's the policy that Nature follows with regard to citing unpublished data:
Manuscripts are sent out for review on the condition that any unpublished data cited within are properly credited and the appropriate permission has been sought. Where licenced data are cited, authors must include at submission a written assurance that they are complying with originators' data-licencing agreements. Referees are encouraged to be alert to the use of appropriated unpublished data from databases or from any other source, and to inform the editor of any concern they may have.
The definition of plagiarism "again":
"the practice of taking someone else's work or ideas and passing them off as one's own."
Until and unless you are not claiming the work as your own, you are not plagiarising. Give the credit to the original author and take his/her consent before working on it.
One of the most important things to keep in mind while writing a new thesis is to cite correctly. Don't forget secondary citation while working.
Name the original work in-text and cite the secondary source you have seen. Include only the secondary source in the reference list.
A work is published if it is given to anyone other than the author. So the mere fact it has not been published online is not to say it has not been published. So the thesis should be considered as a published work - in that sense your question is poorly framed.
You are, of course, able to cite another's work but you should not seek to pass it off as your own. You can extend it and seek publication for the extended work, but whether it will be worthy of publication will likely depend on the nature of the extension.
But an unpublished paper is a better outcome than being accused for all time of being a plagarist.