Hmm ... after further experimentation, I still can't get this version of systemd (231) to do anything evil. It turns out that Fedora ships it with KillUserProcesses turned off by default, and maybe having that on is a prerequisite for the other behavior? But that doesn't make a lot of sense because we'd never be seeing the reports of databases moaning about lost semaphores if the processes got killed first. Anyway, I see nothing bad happening if KillUserProcesses is off, while if it's on then the database gets shut down reasonably politely via SIGTERM.
Color me confused ... maybe systemd's behavior has changed?
Hrm, the following incantation seems to break for me on a fresh Fedora 25 system: