JSON: backslash added to &, is it by design?

[justanotheranonymoususer]

My yaml:

      - id: tj-actions-changed-files
        uses: tj-actions/changed-files@v45
        with:
          json: true
          escape_json: false
      - env:
          ALL_CHANGED_AND_MODIFIED_FILES: ${{ steps.tj-actions-changed-files.outputs.all_changed_and_modified_files }}
        run: my_command_here

If a changed file has &, it's escaped. For example:

ALL_CHANGED_AND_MODIFIED_FILES: ["dir/one \& two"]

This is not a valid JSON, so my script fails. Note that it happens even though I passed escape_json: false.

Is it by design?