Thanks to Albert for the initial hint, see https://blog.thewalr.us/2017/09/26/raspberry-pi-zero-w-simultaneous-ap-and-managed-mode-wifi/
However, I decided to use systemd-networkd instead of /e/n/i, and it seems no ugly workaround is needed.
I have this rule in /etc/udev/rules.d/70-phy.rules :
SUBSYSTEM=="ieee80211", ACTION=="add|change", DRIVERS=="brcmfmac", \
RUN+="/sbin/iw phy %k interface add ap0 type __ap"