I don't know if the issue is with bash or sshd, but I believe it's more sshd since the same can be reproduced with zsh but not ksh.

When having a HEREDOC processed through ssh, it appears that any stdin consumer will "eat" the next lines in HEREDOC instead of reading on standard input, as shown in the example below:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ ssh -t -t localhost << EOF
tty
cat
echo HELLO
EOF

tty
cat
echo HELLO
[root@vm-rhel8 ~]# tty
/dev/pts/1
[root@vm-rhel8 ~]# cat
echo HELLO
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Here above the "echo HELLO" should not have been seen since at all, it's written here because it was processed by "cat", and now "cat" continues waiting on stdin for further commands.

I'm expecting this instead, as seen on RHEL7 which has 7.4p1:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[root@vm-rhel7 ~]# ssh -t -t localhost << EOF
> tty
> cat
> echo HELLO
> EOF

tty
cat
echo HELLO
[root@vm-rhel7 ~]# tty
/dev/pts/1
[root@vm-rhel7 ~]# cat
---> this is "cat" execution waiting on standard input. "echo HELLO" was not processed yet.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


With "ksh", this continues working fine:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ ssh -t -t localhost ksh << EOF
tty
cat
echo HELLO
EOF
tty
cat
echo HELLO
# 
/dev/pts/1
#
---> this is "cat" execution waiting on standard input. "echo HELLO" was not processed yet.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This happens on 8.0p1 and later, including up to 8.8p1 at least.
It seems like that this is due to having non-blocking mode for stdin file descriptor somehow, since using Ctrl-C "breaks" the shell and I need to use "reset" to makes the shell work fine again.

This prevents any HEREDOC to be passed through ssh, as shown in the following "legit" example:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ ssh -t -t vm-rhel8 << EOF
systemctl status sshd
echo "RC $?"
exit
EOF
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

HEREDOC execution:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
systemctl status sshd
echo "RC 0"
exit
[root@vm-rhel8 ~]# systemctl status sshd
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset>
   Active: active (running) since Thu 2022-06-16 08:53:15 CEST; 48min ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 896 (sshd)
    Tasks: 1 (limit: 11377)
   Memory: 9.5M
   CGroup: /system.slice/sshd.service
           └─896 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-po>

Jun 16 09:36:25 vm-rhel8 sshd[2832]: pam_unix(sshd:session): session opened for>
Jun 16 09:36:41 vm-rhel8 sshd[2895]: Accepted publickey for root from 192.168.1>
Jun 16 09:36:41 vm-rhel8 sshd[2895]: pam_unix(sshd:session): session opened for>
Jun 16 09:39:19 vm-rhel8 sshd[2958]: Accepted publickey for root from 192.168.1>
Jun 16 09:39:19 vm-rhel8 sshd[2958]: pam_unix(sshd:session): session opened for>
Jun 16 09:39:19 vm-rhel8 sshd[2958]: pam_unix(sshd:session): session closed for>
Jun 16 09:39:39 vm-rhel8 sshd[3026]: Accepted publickey for root from 192.168.1>
Jun 16 09:39:39 vm-rhel8 sshd[3026]: pam_unix(sshd:session): session opened for>
Jun 16 09:41:55 vm-rhel8 sshd[3078]: Accepted publickey for root from 192.168.1>
Jun 16 09:41:55 vm-rhel8 sshd[3078]: pam_unix(sshd:session): session opened for>
...skipping...

                   SUMMARY OF LESS COMMANDS

      Commands marked with * may be preceded by a number, N.
      Notes in parentheses indicate the behavior if N is given.
      A key preceded by a caret indicates the Ctrl key; thus ^K is ctrl-K.
...
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Here above, the "systemctl status sshd" command spawns the pager which reads the next line ("echo "RC $?"") and processes it as "pager" commands, which ends up bipping and displaying "pager" help.