If the token is meant to be output into raw HTML and is not otherwise validated, it's possible for the result to contain reserved character sequences that can only be solved by preemptively HTML-encoding.
For example, the string
You &me; him &her;
will create parse errors because the &*; sequences are parsed as character references. Encoding the & to & removes the confusion. IIRC, Marketo outputs decimal references, but it's the same idea.
I've definitely seen problems that are solved by HTML-encoding, but it can't solve everything. And if you do choose to encode, you have to remember that parsing the tokens as JS strings won't work anymore. It's an either/or.