The source of your confusion is probably CMake’s peculiar interpretation of quoted strings.
For example, the following all iterate over the list of strings correctly:
(1) foreach(LETTER a b c) [...]
(2) foreach(LETTER a;b;c) [...]
(3) set(MYLIST "a;b;c")
foreach(LETTER ${MYLIST}) [...]
The only case where this does not work is
(4) foreach(LETTER "a;b;c") [...]
The reason why (1) and (2) work is found in CMake’s language manual for unquoted arguments:
Unquoted argument content consists of all text in a contiguous block
of allowed or escaped characters. Both Escape Sequences and Variable
References are evaluated. The resulting value is divided in the same
way Lists divide into elements. Each non-empty element is given to the
command invocation as an argument. Therefore an unquoted argument may
be given to a command invocation as zero or more arguments.
Note that this is different from quoted arguments, which also evaluate Escape Sequences and Variable References, but do not do the list expansion. This explains why (4) fails.
The interesting question now is why (3) still succeeds. set will accept both single value and list value arguments. In fact, everything before the closing ) or one of the keywords CACHE or PARENT_SCOPE is considered part of the value. As such, the following two commands are equivalent:
set(MYLIST "a;b;c")
set(MYLIST a;b;c)
In both cases the value of MYLIST will be a;b;c (without the quotes).
When we now expand ${MYLIST} into another command, you can think of it performing a simple string replacement with the value of MYLIST, which is a;b;c. The resulting command will then get expanded via the rules of of quoted or unquoted arguments. That is, the following will work:
foreach(LETTER ${MYLIST}) [...]
while this will not:
foreach(LETTER "${MYLIST}") [...]