Good catch and that's definitely true as well but there's no way the author could have passed an ampersand into a Go string (ie as a parameter in said tool) without understanding the need to escape it in the first place. The shell would have parsed the ampersand as a reserved token out before the URI encoding bug was exposed.
As first project though, it's a great learning exercise for the author. We all have to start somewhere.
curl -s https://trace.moe/api/search?url=https://foobar/baz.jpg
And in the project the URL is simply appended:
https://github.com/irevenko/what-anime-cli/blob/main/cli/lin...
The API provides both GET and POST methods of passing the image file or URL and the author has somehow mangled them both into one as well :)
https://soruly.github.io/trace.moe/#/