How can I exclude folders when updating drupal using drush?
If you want to update Drupal core without updating contrib, use drush pm-update drupal.  Always upgrade a copy of your site and test it before modifying your production site.

If you want to avoid updating just a specific contrib project, use drush pm-update --lock=skipthis.  The lock is persistent until removed with --unlock.