Yes, it's normal. The root user can do anything (including, say, changing a user's password, logging in as them, and changing it back), so they aren't restricted by
sudo). That includes password prompts and any other restrictions.
The PAM configuration can be set up to have
su present certain prompts to the root user still, for example encryption keys, but it isn't the default, it isn't reliable, and it can be disabled. The root user can easily switch to another user by other means, like creating a setuid executable owned by the user or just calling the
setuid function in one of their programs.