Hello,
All methods that add contents apply the htmlspecialchars automatically to convert special characters. The replaceVariableText doesn't apply htmlspecialchars automatically to the new values. A patch to apply htmlspecialchars in replaceVariableText values has been added into the testing branch to be included in the stable release.
Using the current stable release, please apply it manually:
$xlsx->replaceVariableText(array('val1' => htmlspecialchars('Hi & Welcome')));
Regards.