Asana support have confirmed that this is ‘expected behaviour’ - I have created a project template which includes a form that is utilised roughly half way through the project to initiate a separate process that runs alongside the main project.
When the project is started, it does not inherit the form-level access requirements required as’ organisation only’, it reverts back to ‘anyone can submit’ even if you go into the form and mark as organisation only - when the template is generated.
So my expectations for the form are slightly aspirational - but would be great if this use case could be considered 
<<Asana support response - The key distinction here is how templates function when creating a new project. When a project is generated from a template, most project-level configuration and task structure are copied into the new project. However, forms are treated slightly differently because they are designed to operate as shareable intake endpoints that may be distributed outside the project itself (for example, via links, websites, or external submissions).
As a result, certain form-level access controls are intentionally reset when the template is used to create a new project. This prevents a situation where a form inherits a permission scope that may not align with the access configuration of the newly created project or the team it belongs to. In other words, the system defaults the form to a broadly accessible state so that the form remains usable immediately after project creation, regardless of where the new project lives or who has access to it.
I realize that in workflows like the one you described — where the form submitter determines assignments or routing — this behavior can feel counterintuitive, since the expectation is that all configuration from the template carries over exactly.
For teams that rely on stricter submission permissions, the most common approaches are:
• updating the form’s “Who can submit” setting immediately after the project is created from the template
• including that step as part of the project setup checklist or automation process
• attaching the form to the project after creation if tighter access control is required from the start>>