What it boils down to is that as long as you stick to users and groups, su works just fine.
But systemd is using cgroups and pam to do session tracking, and using su within that seems to break some elements of their tracking (or some concept within it).
Thing here is that su is doing the job it has always done, so frankly it is the systemd session tracking code that is in the wrong.
True, but for most of us there's more than just groups and users. su is helpful to add other users' privileges to the current session, but there was no command to create a new full, isolated session other than logging in on a different tty or ssh'ing to localhost.
`machinectl shell` now implement that feature, with the added bonus of being transparently able to log into a local container (or possibly even virtual machines).
