It is to do with with HTML/XHTML compatibility. Before HTML5 having unencoded ampersands in URLs and in some other contexts was invalid. From XHTML validator:

Entity references start with an ampersand (&) and end with a semicolon (;). If you want to use a literal ampersand in your document you must encode it as "&" (even inside URLs!). Be careful to end entity references with a semicolon or your entity reference may get interpreted in connection with the following text.

Common HTML Validation Problems - Ampersands (&'s) in URLs

Ampersands, PHP Sessions and Valid HTML

It is to do with with HTML/XHTML compatibility. Before HTML5 having unencoded ampersands in URLs and in some other contexts was invalid. From XHTML validator:

Entity references start with an ampersand (&) and end with a semicolon (;). If you want to use a literal ampersand in your document you must encode it as "&" (even inside URLs!). Be careful to end entity references with a semicolon or your entity reference may get interpreted in connection with the following text.

Common HTML Validation Problems - Ampersands (&'s) in URLs

Ampersands, PHP Sessions and Valid HTML