Rebooting and/or restarting services isn't a bad thing, in general. In the specific case of bash & shellshock, the issue is that a newly started shell may execute unwanted code supplied by environment variables passed to it. A shell which is already running has either done that, based on malicious environment variables, or not. Assuming not, there is no security reason to restart it.

The primary redhat risks are DHCP clients of malicious servers (think hotel or coffee shop with rogue wifi access points) and CGI scripts called from web servers. The script doesn't have to be written in bash per se, it just has to call system() or popen() or anything else which will launch a bash shell. But after patching bash, it is not necessary to either restart the web server, or anything else.

-- Jim Leinweber, WI State Lab of Hygiene