Defaulting to just "cmd.exe" can execute an arbitrary program named "cmd.exe" in the application directory or current directory.
When CreateProcess needs to find the shell to execute a batch file (.bat or .cmd), it doesn't search for "cmd.exe" -- at least not in NT 6. If ComSpec isn't set, it defaults to "%SystemRoot%\system32\cmd.exe". If both ComSpec and SystemRoot are unset, executing a batch file via CreateProcess fails with ERROR_DIRECTORY.
I think Python should use the same default path if it's ignoring ComSpec:
default_shell = path.join(environ["SystemRoot"], "system32", "cmd.exe")
A KeyError shouldn't be a problem here. CPython won't even run if SystemRoot isn't set to the correct path:
C:\>set SystemRoot=
C:\>py -3
Fatal Python error: Failed to initialize Windows random API (CryptoGen)