To the remote administration point, if you have this architecture and still open up the private data-network to remote SSH connections, you're at least limiting the attack space to vulnerabilities in SSH and the network stack/firewall on your ingress server, but not vulnerabilities in the application server. Much better than nothing.