I think that's pretty much the way it goes. As I recall, if you open CA on
a WFE, you're redirected to the application server anyway.

Your Central Administration site is a vital part of your SharePoint farm. As
such, you should be running it behind the scenes, on one of your Application
servers, where it is a bit safer, not contending with user requests coming
in for sites and simply out of the way.

The only other thing I would add to this is to host it on a non-clustered
address. This is why the app server is usually a good bet. It allows you the
option of performing quick troubleshooting to rule out NLB and/or hardware
clustering.