The short answer is that velocity loops will not work with the Forms notification body.
Form notifications support velocity for primitive variables, like strings, numbers, and booleans. However, without the templating context that the Send Email action has, form notifications can’t handle arrays and objects. This is because inline variables are implemented in Golang, and they output arrays and objects using Golang notation. This means that arrays will look like this:
Velocity is built on Java and requires Java syntax for arrays and objects, which is not how inline variables are resolved. The reason you see a 400 error when attempting to setup a loop for an array is because it actually resolves to this in the code.
The templating context in Send Email must be properly converting arrays and objects to the correct Java syntax, which is why the loop will work in Send Email.