Remote command has different umask
Solution 1:
From the bash man page:
When an interactive shell that is not a login shell is started, bash reads and executes commands from
~/.bashrc, if that file exists. (...) When invoked as an interactive login shell, or a non-interactive shell with the--loginoption, it first attempts to read and execute commands from/etc/profileand~/.profile, in that order.
In your first command (ssh user@host "umask") it is not a login shell, in the second case, it is. So check your ~/.bashrc file for a umask 0002 command.