@Vero Hi. Thanks for taking a look into it.
My configure is here:
I tried several times and come to this conclusion:
After a reboot of the system, when you first launch a 3rd party application, e.g., wireshark, it will open on the acive (macbook display) even if the active display is the external display. However, if you drag the wireshark window to the external display, close it, and then open it again while keeping the active display still the external display, then wireshark will open on the external display.
On the other hand, for apple software, particularly "preview.app", it will always open on the macbook display.