Technically they aren't entities, they are either entity references or character references. For example, & nbsp; is an entity reference, while & #xa0; is a character reference.
XSLT 1.0 gives the serializer free range on this: it can do what it likes, so long as the serialized form is an accurate representation of what is in the result tree. Your particular product might give you more control (Saxon 6.x does, for example, though an extension attribute in xsl:output called saxon:character-representation).
Author, XSLT Programmer's Reference and XPath 2.0 Programmer's Reference