How do I exclude/blacklist admin paths? Is there still a way to exclude administrative paths from using the CDN module in Drupal 8?

It appears you have to use advanced mappings, but I don't understand how.
No, not currently. As the UI suggests, the complex mappings can be set in the module's install/config/cdn.settings.yml config file, but it only allows for segmenting traffic to different CDNs based their extension. 

The FileUrlGenerator service object handling the file URL rewriting doesn't consider a path context while deciding when/when not to serve file from the CDN. 

You could replace this service class via the ServiceModifierInterface and its ::alter() method with a custom service class that does consider the path context.