Both programs are suid root. There is no reason to ever type "sudo su"sudo su except for the situation where one is unfamiliar with the "-i"-i and "-E"-E options to sudo, or otherwise in the habit of doing things as root without understanding why they're done. The su commands passes through a few hard-coded environment vars (or, on recent Linux, can use -p to pass through the entire environment), while sudo can control exactly which onesvariables pass through (try $DISPLAY$DISPLAY for a useful example). The su command can only prompt for the target user's password (assuming a default pam stack), while sudo can be configured to authenticate as the source or target user, or neither, or always root - and can do so per command. The susu command resets $HOME$HOME, while sudo can decide based on the ruleset available. And that's one more forked process that doesn't need to exist. Meanwhile, sudo logs the commands that it runs, so as long as you're not just doing sudo -i or otherwise launching a shell, you can get a way better audit trail with sudo. When you run a command using sudo, it removes both . and empty elements in $PATH and then checks those last if they were present, preventing people from sticking a shell script named "ls" in /tmp and similar shenanigans. :)
Basically, "sudo su"sudo su is like nailing one hand behind sudo's back and gaining nothing. :)