Named entities like & read naturally; numeric forms like & — or hex & — work for every character even when no name exists. Entities exist so markup characters can appear as text: without them, a lone < starts a tag and breaks the parse.
In practice only five characters must be escaped in HTML: < > & " ' — escaping the rest is readability, not safety.
Reference table: full HTML5 named character references — type to search, click a row to copy its entity code.