Here is why you guys don’t agree I think.
Shortfall risk does not assume normal distribution. Shortfall risk is simply defined as “the risk that portfolio value will fall below some minimum acceptable level during a stated time horizon.”
You DON’T HAVE to use standard deviation to solve it. You can just look at the historical distribution of returns on a graph, and look how much probably there is to fall below your targeted return for example.
Of course, if you use standard deviation to solve shortfall risk, then you have to wonder if normality really is a relevant assumption. But this issue is not inherent to shortfall risk. It’s just due to the method you chose.