Noindex,Nofollow in theme’s header.php?

I think not. Because it’s not indexing the result page:

See:

<?php if (is_search()) { ?>

if is Search doesn’t index or follow the page (for example to not show duplicated content). But you can remove the code if you feel you are losing views.

I was reading an article about this. Even if WordPress doesn’t generate the /s=X page automatically, some plugins or even users can generate.

My recommendation is to keep the code.