exclude.php

<?php

function exclude_post_categories( $exclude = '', $spacer = ' ' ) {
	$categories = get_the_category();
	if ( empty( $categories ) ) {
		return;
	}
	$exclude = explode( ',', $exclude );
	$counter = count( get_the_category() ) - count( $exclude );
	foreach ( $categories as $cat ) {
		$counter--;
		if ( in_array( $cat->cat_ID, $exclude, true ) ) {
			continue;
		}
		?>
		<a
			href="<?php echo esc_url( get_category_link( $cat->cat_ID ) ); ?>"
			title="<?php echo esc_attr( $cat->cat_name ); ?>"
		>
			<?php echo esc_html( $cat->cat_name ); ?>
		</a>
		<?php
		if ( 0 === $counter ) {
			echo $spacer;
		}
	}
}

Taken and improved from https://css-tricks.com/snippets/wordpress/the_category-excludes/:

• fixed a bug where $post was used but never declared
• fixed security bugs due to lack of escaping
• applied WP coding standards
• reduced cyclomatic and NPath complexity
• checks now exit early
• eliminated early escaping by outputting directly and escaping on output
• the exclude argument was renamed to make more sense in PHP 8.0 when using named arguments

lowhanging fruit, wp_parse_str or wp_parse_args could allow the exclusion parameter to be both "1,2,3" or [1,2,3]