... why output is "&& &" but not "&&&"?

After the first match on  '& &' (which is replaced with '&&'), the 'match point' in the string is sitting just after the second '&' and just before the second space. The regex pattern needs at least three characters to match, and at that point there remain only two characters in the string.

In general, the regex of the OP will only match successive triplets of  '& &' leaving a single  \s between each substituted  '&&' pair because after each match the regex engine must scan forward to find, at the very least, another  \W\s\W triplet. (Heed Corion's caution that  \W includes all  \s characters!)