As you say, shapeshifting a lot is reasonable. It's a thing the Druid can do and there are no (overt…) restrictions on the move, so adding some is a bad idea and will just take away what makes the Druid the Druid.
But it does have restrictions; they're just not obvious because the move is carefully taking advantage of restrictions that are baked into the rest of the rules. Let's look at them:
The Druid doesn't get to pick their form's moves
Don't ask what the Druid is planning to do! That's giving away one of your means of interacting with the Druid meaningfully. Instead, think about what is archetypal of the form and give it moves for that. An Eagle might have any or all of
- See far and clearly
- Rend with claws
- Fall upon prey with the sun at my back
An elephant might have
- Trumpet deafeningly
- TRAMPLE THEM!
The form doesn't even have to always have the exact same moves list — you can tailor it to the needs of the situation that are obvious to you if you feel like that's following your Agenda and Principles — but by default, give non-fancy “this is just what an eagle does” moves instead of giving the player input.
The archetypal moves say something about the form. It says what it is suited to, and it should be you making that statement. It also emphasises that this is an animal's form, and it's good at doing things that animal is good at, rather than whatever is convenient. Let the Druid use the ability to shapeshift to look for convenience — letting them also help decide the moves they get is letting the Druid double-dip on the move's convenience.
Shapeshifting is powerful, and therefore it is Dangerous
Shapeshifting seems easy — just do the move and it happens! But it only seems easy when it's done successfully, because the Druid did it successfully. Constant, “on demand” access to such a powerful effect is a hallmark of the Druid, but that doesn't mean that it's wise for the Druid to use it like it's going out of style.
Misses are supposed to matter, and the more risky the in-world action, the more extreme events are on a miss. What's more risky than inviting the soul-shattering power of Unbridled Nature into your body to utterly erase your human form and replace it with an animal? Just imagine how that could go wrong. Misses are that going wrong.
I'm going to quote myself from elsewhere to explain this further:
The absolute key to the power of druid shape-shifting is to never, never let them off easy when they roll a miss. The benefits of a hit are huge and awesome, and they should get the full power of the move. But the risks are proportionate to the benefits: when they miss, it should hurt. A lot.
Consider that what they're hoping to do is tap into the unimaginable power of nature to change their body into a new form. Imagine all the (fun!) ways that could go horribly, horribly wrong. Then do those things on a miss.
For example, the last time I had a druid in my game, a shapeshifting fail completely drove the story arc. We'd established (through me asking questions) that the way it worked is by asking a pet spirit of the form to lend the druid its shape, then give back the human form when done. So they had a bunch of fetishes hanging off their belt, one for each form they knew. During a Elephant-form shapechange attempt while hurtling over a deep abyss of unnatural darkness (it made sense at the time!), they rolled a miss — so their Elephant spirit was eaten by the darkness and their fetish fell to ash, but not before the druid became an elephant. As a result, they were stuck in Elephant form because the Elephant spirit wasn't there to give the human form back!
This was the first miss after many successful (and powerful) uses of Shapechange. The druid super-respected the power after that, and used it much more thoughtfully.
They eventually got better, after consulting a nature oracle and entering the Spirit World to rescue Elephant (and their human form) from the Darkness Great Spirit that had eaten it — the latter of which became a major plot element, eventually culminating in an epic campaign-ending where they raised The Silence And The Darkness up to be a new demigod of the Forgotten Realms. That one missed roll snowballed so much of that game, and prompted the improvisational GMing that eventually became the groundwork for the campaign climax. It was great.
So this is the key to Shapechanging: make those misses count, so that the druid never, ever takes the ability for granted and never considers it a completely “safe” thing to attempt.
That quote really states the case strongly, but then it was in response to a GM who was completely at a loss for how to GM for a particular Druid player. But it's a dial that you can turn up and down, tuned for exactly how dangerous the situation is or how carelessly the Druid was shapeshifting. This is the main dial that makes Shapeshifter not a “win button”.
Misses on Shapeshifter don't have to always be cataclysmic, because sometimes something else will be more obviously the best GM move to make. But making even a few misses demonstrate the untamed power that the Druid is allied with and tapping into will make the Druid's player properly appreciate and respect the Shapeshifter move (and Nature) and stop using it like a hammer for every trivial situation.
For your specific situation, I recommend a lighter touch at first, but still a Hard move — definitely lighter than the story above about How Elephant Was Eaten by the Darkness. Based on your Druid's particular shapeshifting idiom, on a miss maybe give them a hybrid shape the first time —
A miss? Oooh. Okay, you start to shift, feeling the power of nature flash through you like lightning to change your body, but then it's gone again, too soon! You're shifted, but into a horrible and horribly ungainly half-human, half-eagle form.
Your new form gives you the moves “Squawk painfully without human words”, “Hop gracelessly across the ground with useless wings”, and “Tear awkwardly with an ill-formed beak”.
The Druid's reaction will almost certainly be to shapeshift again (whether straight away, or after dropping back to human form) as soon as possible, but that's “fine”, in the sense that they can make that choice — with its inherent risk of another miss. That's just one idea for a miss though — once you start thinking of Shapeshifter misses as Golden Opportunities to show a downside of the class or make other interesting Hard moves, you'll start coming up with all kinds of beautiful, situation-tailored GM move results for those misses.
Just by showing them that misses have (like they always should) meaningful consequences in Dungeon World, you'll put a bit of caution into their use of Shapeshifter in an organic, DW-native way.