@Dave_Barnes, thanks to you I found this: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1457400
I think it might be the closet thing on launchpad matching our current problem.
I've modified /etc/systemd/system.conf and set a 6s timeout value, though I'm not sure I did that correctly.
DefaultTimeoutStartSec=6s
DefaultTimeoutStopSec=6s
TimeoutSec=6s
What I can say for now is that I don't appear to have bricked my system, and based on a few cycles of power-on / shutdowns, it seems like it does the trick. I'll continue testing and report here if I notice the problem again.
Of course, that's just a workaround that's not really fixing the underlying problem that one process killed during the shutdown must be ignoring the SIGTERM signal, or making wrong assumptions about what the standard user would want it to do when signaled.