Why doesn't su have its setuid bit set?
See this answer at Unix.SE. Instead of the setuid bit, the binary has some capabilities set via file's extended attributes. The particular caps are of interest are CAP_SETUID and CAP_SETGID.