How can I exclude folders when updating drupal using drush? How can I use drush pm_update and exclude some folders? For example, I don't want to update Sites and Profiles folders.
If you want to update Drupal core without updating contrib, use drush pm-update drupal.  Always upgrade a copy of your site and test it before modifying your production site.

If you want to avoid updating just a specific contrib project, use drush pm-update --lock=skipthis.  The lock is persistent until removed with --unlock.