In Plone 5.0.7 I have some JS on a page that is loading content from another site. Here is an example:
Notice the url has & to separate the parameters instead of just &. This is a change that Diazo is making, and it's preventing the JS from working properly.
Yes, it also happens in Barceloneta. I did not test the site settings JS. This particular code will appear in the body text of pages, but I did also test from the index.html and a browser view template, and still got &.
You fall into an HTML versus XHTML discrepancy. The behaviour you observe is correct for an XML document (such as an XHTML document); it is problematic for HTML. The reason: HTML defines "script" as an element with "CDATA" content (therein markup is not recognized); XML does not know such elements - all element content is parsed for markup and therefore "&" should be coded as "&". Part C4 of the XHTML specification suggests to use external scripts in those cases to avoid the problem.