I wonder if the person who posted that patch was basing the implementation on >>312-314, which is also missing &.
In related news, various threads suggest that 2ch doesn't seem to run htmlspecialchars -- or at least, not for some characters.
Namely, lots of the "novelty" tripcodes listed in posts like http://gimpo.2ch.net/test/read.cgi/puzzle/1129465527/203 have such characters as & and ' in them. It doesn't make a ton of sense to me for someone to post these if they have to be reencoded in order to be used, considering the "fixed" tripcode could be posted just as easily and it's a fairly trivial process. So what gives?