Ok I found what it is.
Diffing the /etc/sudoers file from 24.04:
Defaults log_subcmds
Defaults log_format=json
was added. If removed everything works as before. If you don’t want to remove these lines you can add:
Defaults !intercept_verify
to fix the sudo su - bug
For me adding the !intercept_verify fixed my Ansible issues. And removing the 2 lines above fixed why I couldn’t run any command in lxc-attach anymore.
2 nights of fiddling to understand why my whole automation stopped working 
I didn’t know sudo could be configured to intercept commands. Interesting.