Where exactly does that message come from? Su itself, PAM, some other library?

I think it's from sudo, not su.

Indeed:

https://github.com/sudo-project/sudo/blob/SUDO_1_9_9/plugins...

But this particular message was removed in sudo 1.9.10:

https://github.com/sudo-project/sudo/commit/6aa320c96a376136