SSH Server: I only allow public-key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would make it worse, but the issue here is not password strength but having trusted a malicious application.
Physical Access: su access is irrelevant at this point, the attacker has physical access to my hard drive, so they can do as they wish.
So, in what scenario does having a strong password that is error-prone to type help me?