Why everybody wants to invent their own crappy password hashing scheme? Just pick one of already widely used ones, eg.: PBKDF, bcrypt, scrypt, any non-DES-based algorithm offered by crypt(3)... And when you want to really design your own scheme, at least look at how all previously mentioned schemes are designed and try to understand why.
And as for why this scheme is bad: your application has access to this "protected file" with secret shared key and so does attacker.
The real kicker is that he tries to justify it by saying a sql injection attack would prevent the attacker from getting passwords. If you're seriously worried about sql injection, inventing a retarded password scheme seems like a secondary worry to revising your coding standards to require prepared statements.
Treating any part of a user password scheme as secret is doing it wrong. This is why bcrypt exists.
Protecting one part of the system against code/development errors in other bits of the system seems like the sane thing to do. Maybe this guy is in control of the password scheme but not in control of the SQL stuff.
And as for why this scheme is bad: your application has access to this "protected file" with secret shared key and so does attacker.