I don’t know either. Using dnf up --refresh should be fine. And according to your history, the wrapper added --exclude=kernel* and --disablerepo=zfs* just like it was supposed to, so I don’t see how the kernel could have been updated when that command ran unless there is a problem with dnf itself.
Let me know if you figure it out. I just tested it on my system and it seems to be working correctly.
You might check your Bash history (using the history command) to be sure you ran what you thought you ran.
Thanks.