How can I use
drush pm_update and exclude some folders? For example, I don't want to update Sites and Profiles folders.
If you want to update Drupal core without updating contrib, use
drush pm-update drupal. Always upgrade a copy of your site and test it before modifying your production site.
If you want to avoid updating just a specific contrib project, use
drush pm-update --lock=skipthis. The lock is persistent until removed with --unlock.