The shadow package did now ship the su program even before this,
Debian uses the util-linux implementation of su (since Buster).
In shadow 4.8 there's now an explicit configure flag that can be
used to disable su explicitly, rather than just not shipping it in
the resulting debian package.
See commit 88de51965d
"Stop shipping su and break old util-linux version. (See #833256)"
A testsuite is also available. Instruction on how to run this testsuite are available in tests/README -- Balint Reczey <rbalint@ubuntu.com>, Sat, 12 Aug 2017 18:46:44 -0400