Why are the pam_tally and pam_tally2 failed attempts count wrong, with sudo?

Issue

• When activating pam_tally.so or pam_tally2.so in system-auth-ac, and the following command is excecuted, the faillog counter is increased before any password is given by user:

$ sudo -k su -

• After one wrong password is typed in, the faillog counter is again increased (to 2)