If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the physical access point where both sets of wireless data propagate through?
Quite a lot of "enterprise" type access points offer functionality to allow multiple SSIDs on a single AP, and it's a pretty common configuration from what I've seen.
From a logical perspective the networks should be isolated (using VLANs or similar type of segregation). You should also be able to specify different authentication mechanisms, encryption types etc.
If correctly configured and patched, this shouldn't pose a major risk, however it does increase the complexity of the environment which always poses security risk (ie, one logical misconfiguration can cause a serious issue)
In terms of the Denial of Service risk, wireless networks can effectively always be DoS'd if an attacker wants to as a powerful enough radio source can cause denial of service on the signal and things like Deauth floods are pretty hard to stop too, from what I've seen.
Right! Your AP becomes a single point of failure and the key to the castle, if someone happens to get a privileged access to your public network by compromising your access point, your secured network isn't anymore!
As both Serge and Rory mentioned, it would require an exploit in the firmware of the Access Point, so if you can access the Access Point and configure it, your more secure network would be compromised. As for VLAN security, there is some best practices, Check this link on Cisco VLAN Best Practices
All in all, I would not recommend you to have two segmented wireless network, unless it is really needed I would skip the high-consequence network (the one with access to workstations, servers, domain controllers etc) and only have a guest network.