Secure setting for shell for unused root account
Basically bash and sh are two different shells, have a look here. Maybe an Apple employee liked sh more than bash and changed? :-)

This question and answer discuss login shells in some details. But the short answer is yes, it always makes sense to put the login shell for root to something non-existing. 

(Technically it is not always, but in those cases you hopefully don't have to ask that question :-) )