The point in the RFC is that the server should be looking at both the "executable" and the "read" bits when deciding whether or not to grant read access to the client. ...
I'm totally aware of the fact that this approach to enhance the security is dysfunctional and pretty lame [sigh].However if you really want to prevent OTHER+GROUP from reading and executing your shell scripts, then "chmod 500 /bin/ls.sh" is your simplest solution. That does the same thing on both the local and remote filesystems.