After updating to 4.17.0, running su - no longer invokes a login shell.
I've built the source with --with-libpam and using the following pam config for su:

auth required pam_env.so
auth required pam_nologin.so successok file=/etc/nologin
auth sufficient pam_rootok.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so

account sufficient pam_unix.so likeauth nullok
account required pam_deny.so

password required pam_unix.so nullok use_authtok md5 shadow
password required pam_deny.so

session required pam_unix.so