When libstrophe uses libxml2 to parse the stream and an attribute contains a basic XML entity such as & the value given to xmpp_stanza_set_attribute will have the numeric form of the entity in it &#xx; instead of being decoded. As xmpp_stanza_set_attribute assumes you are passing the true value not an encoded value this eventually results in the value &#xx; being passed to the application.
Adding xmlCtxtUseOptions(parser->xmlctx, XML_PARSE_NOENT | XML_PARSE_NONET); fixes this, but there are a lot of scary warnings online about NOENT and I'm not 100% sure that NONET mitigates them all.