(Note: I primarily tested on 27.2, but this doesn't look to be any
different on 28.0.50.) When invoking `M-x shell' over TRAMP from a
local MS Windows system, the default remote shell path is corrupted:

  emacs -Q
  C-x C-f /sshx:server:~/some/file.txt
  M-x shell
  ;; See the default prompt value:
  ;;   /sshx:server:/path/to/some//bin/sh
  ;; ("/path/to/some/" is greyed out)
  RET

The result is: "env: ‘c:/bin/sh’: No such file or directory". You can
also see this with the code used in `M-x shell' to get the remote
shell path:

  (read-file-name
   "Remote shell path: " default-directory shell-file-name
   t shell-file-name)

Eval'ing that from a TRAMP buffer and hitting RET returns "/bin/sh"
(i.e. `shell-file-name'); that is, we lost the TRAMP prefix, even
though the prompt made it look like we'd keep it. If you edit the path
to, say, "/sshx:server:/path/to/some//usr/bin/zsh" and hit RET, the
result is "/sshx:server:/usr/bin/zsh", which is good. The result of
this call is then passed to `expand-file-name', which on MS Windows,
turns "/bin/sh" into "c:/bin/sh". Finally, that gets called on the
remote (running GNU/Linux), and things break.

I've attached a WIP patch that resolves this, but I don't think it's
quite right (hence, I didn't use `git format-patch'). This seems to be
more of an issue with `read-file-name' not being smart enough; even if
we set the `default-filename' argument to nil, the default return
value is still a local (non-TRAMP) path, which isn't right. Since
`read-file-name' is better able to tell whether the user wanted the
default value or they specifically wanted a local shell, it might be
better to fix the issue there. However, that's a pretty widely-used
function, and I'm hesitant to change the behavior in
potentially-breaking ways.

If the current WIP patch does look good though, I can clean it up (add
a comment and a commit message) for it to be merged. Or I can try to
fix `read-file-name' if there's agreement about how it should work in
this case.