FYI, I think I have a recipe for Pi 3 with wifi STA+virtual AP that could be (relatively) robust in limited use cases.

At this point I can run:
- wlan0 in WPA2 client mode as uplink
- a virtual ap0 interface in a bridge, running in Open mode. WPA2 should work also in bridged mode, it worked before I added bridging to the mix.

Both interfaces are using the same channel, the virtual AP has quite feeble coverage so it is only good for proximity access to a config GUI or something like that. Don't expect a "normal" AP, don't expect a regular Pi 3 AP.
It is possible to stop/restart the AP without rebooting or oopsing the kernel That requires resetting wpa_supplicant on wlan0. The STA must drop from its AP and reauthenticate when it comes back.
A wired client to the bridge can communicate with the wifi clients. I used an USB adapter, I didn't test a VLAN on eth0.

This was cooked using the latest Raspbian Lite so that firmware/drivers wouldn't be an issue, but I am fairly confident it should work on other distros.
I don't have a 3b+ or a 0w to test with but I suppose it would work the same as they use the same driver.

Perhaps one day the brcmfmac driver will improve and most of this recipe can go to the trash where it belongs. Until then, and if you feel like a hero: