"Are you completely sure about that?"

Well I was: I argued the same as you when I first encountered it. I even recall giving a similar example where it would fail.

However, looking into it a bit further, I find (in "HTML Living Standard: 13.1.4 Character references"):

"Character references must start with a U+0026 AMPERSAND character (&)."

So, you're right and I'm wrong for the current iteration of the (perpetual WIP) HTML5 standard. I dislike these so-called "living documents" for this very reason. Anyway, thanks for prompting me to re-research this. ++