So wheel is acting as expected? How is this not fixed by replacing auth sufficient pam_wheel.so use_uid group=wheel trust with auth required pam_wh

So wheel is acting as expected? How is this not fixed by replacing auth sufficient pam_wheel.so use_uid group=wheel trust with auth required pam_wheel.so use_uid group=wheel in /etc/pam.d/su? Or replace all pam_wheel.so entries with something else? (i.e. pam_unix.so) This seems like fairly standard behavior these days - are distros really shipping with wheel enabled by default?