As these are nested logistic regression models there is no doubt that Frank Harrell's comment shows how to proceed: do the standard likelihood ratio test on the 2 models,* based on all of the data, to determine whether adding the third predictor improves performance. That has a well established theoretical basis, is more sensitive for detecting model differences than AUC, and it doesn't inherently require cross validation.
Cross validation or bootstrapping to evaluate model optimism and calibration would certainly help bolster your case that your modeling approach is correct, but the emphasis shouldn't be on AUC. There's no harm in showing how much the AUC changes, but that should be a secondary consideration. The
validate function in Harrell's
rms package provides several measures of model quality based on bootstrapping or cross validation, including a Dxy rank-correlation value (both original and optimism-corrected) that can be transformed into an AUC value.
*I'm a bit worried that you seem to be including so few predictors in your model. Logistic regression can have an omitted-variable bias if a predictor associated with outcome is left out of the model. Unlike linear regression, the omitted predictor doesn't even need to be correlated with the included predictors to get biased estimates. That's not to say you should be overfitting, but there are usually so many clinical variables associated with some condition or outcome that only including 2 or 3 would tend to be risky.