We just had an issue where someone was writing a string in some SQL which included &, so I went to figure out how to disable substitutions.
Running in version 25.2.2
In PLSQL developer which we used to use there was a simple toggle on the bottom of the page, unfortunately that is not the case in SQL Developer, but I found that SET DEFINE OFF is the recommended method.
But then I come across some very very strange behaviour.
In a fresh SQL worksheet I mark these two statements and run them together:
SET DEFINE OFF;
SELECT 'One & Two' AS test FROM DUAL;
I tried it and it worked, but when a colleague tried it didn't.
After some debugging I found that it works only if there is nothing before SET DEFINE OFF; AND my cursor is at the start of the page.
So if I do Ctrl + A and then Run statement, it prompts me to substitute. If I go to the end of the page and whilst holding Ctrl mark the whole page, ending at the start of the page(so my cursor is there), it just works(although it does open Script output, but when switching to Query result tab, the results are there).
Cursor at the end(either select from start to end, or Ctrl+A)

Cursor at the start(marked from end to start) (also switched to Query result tab)

I also tried with Run script instead of Run statement. And if my cursor is in the SET DEFINE OFF; block, it works. If its elsewhere, it prompts for substitution.
Run in SQLcl seems to work regardless of cursor position.
We dont use & in SQL often, been using the VS Code plugin for 6 months now and havent needed to yet. But a very weird bug you come across when you do need to use it.