Secure setting for shell for unused root account
Solution 1:
Basically bash and sh are two different shells, have a look here. Maybe an Apple employee liked sh more than bash and changed? :-)
This question and answer discuss login shells in some details. But the short answer is yes, it always makes sense to put the login shell for root to something non-existing.
(Technically it is not always, but in those cases you hopefully don't have to ask that question :-) )