Bash reads <<$'EOF' as the delimiter EOF, but the splitter took the $ into the word and waited for a $EOF line, so the body ran on and swallowed the commands after it. A $ before a quote now only starts the quoting.
Bash expands a here-document body unless part of its delimiter is quoted, and runs the $(...) and backquoted substitutions in it, with quotes as plain text. Leaving the whole body out of the segments hid those commands, so npm --version <<EOF with '$(npm run dev)' in the body was allowed. The commands of these substitutions are now segments of their own. An escaped substitution, or a body whose delimiter is quoted (<<'EOF', <<\EOF), stays data.
A body attached to the segment of its command was still searched by the dev-server check. For npm --version <<EOF && cat, the body line npm run dev made the npm segment look like a dev server. A body is data, so it is no longer part of any segment. An empty delimiter (<<'') is a valid opener again, and its body ends at the first empty line.
The opener pattern read only an identifier, so <<EOF/END stored EOF, <<E"OF" stored E and <<123 was no opener at all. In each case the body was split into segments, or the line after it was swallowed. The delimiter is now read as a shell word with its quotes and backslashes removed, as Bash does. A body that follows an operator at the end of its line (cat <<EOF &&) was split off as a segment of its own. It now goes with the command that opened it.
A << in a comment (echo ok # <<EOF) or an identifier shift ($((x << n))) was read as a here-document opener, so the following lines, npm run dev included, were swallowed into its body. A comment now runs to the end of its line and an arithmetic expression is copied whole, so neither opens a here-document nor splits at an operator. A delimiter line ending in \r (CRLF) now ends the body too.
splitShellSegments() split at &&, ||, ; and & but not at a newline, so a multi-line command such as "cd app\nnpm run dev" was one segment led by cd, and the dev-server block let the dev server through. A newline now ends a segment. The body of a here-document (<<EOF, <<-EOF, <<'EOF') stays in the segment of the command that reads it, so a README written with cat <<EOF that mentions npm run dev is not blocked; a here-string (<<<) or a shift such as $((x << 2)) is not read as one.
L4XB