Why doesn't su have its setuid bit set? I checked the permission of su with ls -l, and found it doesn't have the setuid bit set. This is different from common desktop Linux. Is there any reason behind this difference?

The su binary was installed using supersu on an experimental Nexus device with factory ROM.
See this answer at Unix.SE. Instead of the setuid bit, the binary has some capabilities set via file's extended attributes. The particular caps are of interest are CAP_SETUID and CAP_SETGID.