It is to do with with HTML/XHTML compatibility. Before HTML5 having unencoded ampersands in URLs and in some other contexts was invalid. From XHTML validator:

>Entity references start with an ampersand (&) and end with a semicolon (;). If you want to use a literal ampersand in your document you must encode it as "&" (even inside URLs!). Be careful to end entity references with a semicolon or your entity reference may get interpreted in connection with the following text.

[Common HTML Validation Problems - Ampersands (&'s) in URLs][1]

[Ampersands, PHP Sessions and Valid HTML][2]


  [1]: https://www.htmlhelp.com/tools/validator/problems.html#amp
  [2]: https://www.w3.org/QA/2005/04/php-session