Is it safe to display another site's meta tags on my page?

Your friend is right. The tag content comes from whatever site is being checked, and anyone can build a page whose meta tag content contains HTML. Inserted with innerHTML, that HTML runs inside your site, in your visitor's logged-in session. For example, a content value like <img src=x onerror=...> would execute.

Always escape anything from the fetched page before inserting it: replace & < > " with their HTML codes, or set textContent instead of innerHTML.

Changed it to escape everything. But now titles with an ampersand show as &amp;. How do I fix that without reopening the hole?

Decode first, then escape. The value you extracted from the page source is still HTML-encoded, so decode it to plain text (a textarea element decodes without running anything: set its innerHTML, read its value), then escape that plain text for display. Titles show "&" correctly, and an encoded attack like &lt;script&gt; is decoded to text and then shown safely rather than run. Test with both a normal title and a hostile one.