Hi. I believe that this issue is not fixed if hostapd is pulled in during debootstrapping.
The issue that I have noticed is that when creating an image using multistrap (that is later written to disk) the service will not get masked during postinst due to "systemctl is-active" not running from a chrooted environment. I believe that the same issue will occur during debootstrap if hostapd is pulled in at that time, however I have not verified this. I don't really have a good solution for this but I guess a possible fix could be to see if the current environment is a chrooted one. Since we have solved this in a different way for our needs this is not an issue for us, and if you feel that this is not an issue with Debian I'm fine with you closing this ticket down again. I just wanted to inform about a missed edge case in the fix. Regards Kristofer