So the startup that sent the Cease and Desist has nothing to do with the popular SaaS website you cloned? Startups don't just get to bully owners out of domain

So the startup that sent the Cease and Desist has nothing to do with the popular SaaS website you cloned? Startups don't just get to bully owners out of domain names that use the same name. If the domain was important to them they could have bought it before you did. This isn't legal advice, but I would take the site down (since it sounds like you don't care about it), refuse to transfer the domain, tell them you intend to keep using the domain but would consider having a conversation about selling it to them.