[sneak]

I think it's from sudo, not su.

[jwilk]

Indeed:

https://github.com/sudo-project/sudo/blob/SUDO_1_9_9/plugins...

But this particular message was removed in sudo 1.9.10:

https://github.com/sudo-project/sudo/commit/6aa320c96a376136