Azure app registration process and what is the default Roles and administrators assigned?

Hi community members,

I am new to App registration and have read all the MS references about Azure App registration process but can't find the answer about the default "Roles and Administrators".  I start to check on previous registered apps wanted to learn and follow the best practices.  From those articles it looks like we can assign roles using RBAC, which depends on the app design.  But I noticed that all the apps registered have the "Cloud Application Administrator" role assigned.  Is this by default? It seems like this role "Can create and manage all aspects of app registrations and enterprise apps except App Proxy.".  Not quite following the logic, why and how this works so any insights can share with me would be great help.  Thanks in advance!