You don't have to comply with a cease and desist notice, depending on your risk tolerance. They're not legally binding, like court orders. Rather, they are threats, equivalent to "gimme your lunch money or I'll beat you up"
Yes and hiQ v. LinkedIn has already given us precedent that scraping is not inherently illegal, not to mention X's own scraping to train their AI.
Makes sense that they want to consult legal experts rather than just going with their gut though but I hope those legal experts will work something out that gets them back online.