It's hard to say exactly what the question is.
Maybe you should rephrase it, with something like :
"Is fortinet implementation of VRRP RFC-Compliant?"
The fact is the RFC3768 is obsoleted by RFC5798, where it is stated in section 3 :
VRRP specifies an election protocol to provide the virtual router
function described earlier. All protocol messaging is performed
using either IPv4 or IPv6 multicast datagrams; thus, the protocol can
operate over a variety of multiaccess LAN technologies supporting
IPvX multicast. Each link of a VRRP virtual router has a single
well-known MAC address allocated to it. This document currently only
details the mapping to networks using the IEEE 802 48-bit MAC
address. The virtual router MAC address is used as the source in all
periodic VRRP messages sent by the Master router to enable bridge
learning in an extended LAN.
A virtual router is defined by its virtual router identifier (VRID)
and a set of either IPv4 or IPv6 address(es). A VRRP router may
associate a virtual router with its real address on an interface.
The scope of each virtual router is restricted to a single LAN. A
VRRP router may be configured with additional virtual router mappings
and priority for virtual routers it is willing to back up. The
mapping between the VRID and its IPvX address(es) must be coordinated
among all VRRP routers on a LAN.
There is no restriction against reusing a VRID with a different
address mapping on different LANs, nor is there a restriction against
using the same VRID number for a set of IPv4 addresses and a set of
IPv6 addresses; however, these are two different virtual routers.
Following your comment I goes trough the entire RFC and you're right in the fact it always mention "a set of IP address". It even speak about the "primary address" in a set.
So it's quite clear that the author itended the protocol to support multiple IPs per VRID.
However, nowhere in the RFC is mentioned something like "the router MUST support a set of X IP address for a given VRID"
5.2.5. Count IPvX Addr
This is the number of either IPv4 addresses or IPv6 addresses
contained in this VRRP advertisement. The minimum value is 1.
So I would say, despite the fact the RFC clearly spoke about a "set" of IP address, unfortunately it lacks a "MUST" statement to force vendors to implement it.
I guess we have to conclude that, regarding this specific point, Fortinet implementation is RFC-compliant (but I would say, really border-line).