Other answers have described what the -- means (end of option processing). Here I will try to answer how and why it arises in the context of the TTY-based /bin/login process.

Specifically, if you take a look at the [Service] section of /lib/systemd/system/[email protected] you should see the following ExecStart line:

ExecStart=-/sbin/agetty -o '-p -- u' --noclear %I $TERM

The reason for adding the -- is documented in man agetty:

SECURITY NOTICE

       If  you  use  the --login-program and --login-options options, be aware

       that a malicious user may try to enter lognames with embedded  options,

       which then get passed to the used login program.  Agetty does check for

       a leading "-" and makes sure the logname gets passed as  one  parameter

       (so embedded spaces will not create yet another parameter), but depend‐

       ing on how the login binary parses the command line that might  not  be

       sufficient.   Check  that  the used login program cannot be abused this

       way.



       Some  programs use "--" to indicate that the rest  of  the  commandline

       should not be interpreted as options.  Use this feature if available by

       passing "--" before the username gets passed by u.