I got an answer on the Microsoft Tech community. The short answer is yes, 3 is the maximum number of scopes. Quoting answer here for discoverability:

Yes, the "maxItems": 3 restriction in the schema for the scopes property is intentional. This means you can only specify up to three scopes out of the available options ("team", "personal", "groupChat", "copilot") for a given bot or command list.

This limitation is likely in place to ensure clarity in the bot's experience and to avoid potential conflicts or ambiguities that could arise from enabling all possible scopes simultaneously.