I'm using an installation profile (open-outreach) and additional modules / themes. I don't want drush to update modules that are part of the profile, but would like to update everything else. Is there a command to do this?
This would be a good feature request for the pm-updatecode command. I'd say that the best workaround for this missing functionality would be to tell Drush to lock the modules you do not want it to update. Do this one time:
drush pm-updatecode --lock=project1,project2,project3
Replace 'project1,project2,project3' with a comma-separated list of all of the projects in your installation profile. When you do this, Drush will write a lockfile into the mail directory of each project you mention, creating a persistent lock. Thereafter, you may run drush pm-updatecode without the --lock parameter, and Drush will remember that it should not update any of those modules.
If you wish, you may also lock the modules with http://drupal.org/project/update_advanced, and Drush should respect that as well. Works great in Drupal 6, but I have not tried Drupal 7 (only a dev release is available).
In the RC7 release of Open Outreach we introduced some related functionality cribbed from the Commerce Kickstart distro, see http://drupal.org/node/1852898. There isn't Drush support, but you could navigate to the update notifications page and note there the list of modules that show up.