You are making the same error that led to the popularity of passwords based on a common word and some substitutions.
Your calculation is for 11 characters, each chosen completely at random out of 63 symbols. People don't chose a password that way - we typically can't generate or remember random symbols.
XKCD's calculation is for a common word + common symbol substitutions and additions: log2(#words) + log2(#capitalization options) + log2(#substitution options) + ...
You calculate password entropy of a password drawn from a set of equally likely passwords by taking the log_2 of the size of the set. (This is a convenient special case of the more general formula for entropy.) A convenient thing about this is that if you concatenate two things (in such a way that you can pull them apart again) the number of possibilities is the product of the possibilities for each of the things, so the entropy is the sum of the entropies.
entropy = log2(symbols^chars)
But using 63 symbols ([a-zA-Z0-9&]) I get 65 bits for Tr0ub4d0r&3, not 28.