If you have controlled dictionary where you know what type of values you’ve got, you can use even simpler version of your map method:
arr.map(val => characters[val] || val);
Furthermore, you don’t really need to convert string to array and then array back to string, as string is a perfectly iterable type in javascript. There is no .map() method for string partly because there is much powerful .replace() method. For example, try this right after assigning your characters variable:
return str.replace(/./g, val => characters[val] || val);
Looks similar, right?
And actually, you can further specify what exactly you want to replace in the string:
const re = /[\&\<\>\"\']/g;
return str.replace(re, val => characters[val]);
// You no longer need to check if key exists in characters dictionary