This is a pup bug. pup asks me for the root password when I want to "apply updates", but I do not see the shield that means that the root password will be remembered for a short time.
With the way that pam_timestamp works, it'll only work if you launch it the same way.
So the bug is either that the shield has stopped appearing, or pup should launch the applications the same way that the system-config- tools launch their apps?