What it boils down to is that as long as you stick to users and groups, su works just fine.

But systemd is using cgroups and pam to do session tracking, and using su within that seems to break some elements of their tracking (or some concept within it).

Thing here is that su is doing the job it has always done, so frankly it is the systemd session tracking code that is in the wrong.