When a topic title is long and it gets shortened for display on the main page (an ellipsis is added at the end), then an "&" in the topic title becomes "&" on the main page.
(https://i.imgur.com/xWOt304.png)
This bug manifests in $board['last_post']['link'] and $board['last_post']['subject']
I suspect it happens in the function that shortens the topic title because it doesn't happen to short titles.
SMF 2.0.18
In my opinion the shortening of the title shouldn't even be handled in PHP but by CSS text-overflow property (https://developer.mozilla.org/en-US/docs/Web/CSS/text-overflow), as needed.
Yes that would make sense, but it's legacy code from the days when that CSS didn't exist. SMF 2.0.x only gets really necessary fixes these days, so the old code is still in there.
Replacing the PHP shortening with CSS would make sense for SMF 2.1, if it hasn't been done already.
i bet it is related to https://www.simplemachines.org/community/index.php?topic=576612.0 and the fix within.
I can confirm that the patch by shawnb61 (https://www.simplemachines.org/community/index.php?topic=576612.msg4081408#msg4081408) fixes the problem described here.