It does say he must be able to review them and if they are password protected files he can't do that.
The only reason to password protect them is to hide the content. If you need to hide the content he can not verify if they violate their ToS and therefore he can and has chosen to in some cases not pay on those files.
That is what is said and the intent of the ToS you agreed to by using his service.
That's not the same as saying he MUST be able to review them.Filestrum will not routinely screen, monitor, review or revise User Content uploaded, stored, or shared using the Service. However, Filestrum may review any such content, and Filestrum reserves the right to refuse to accept, store, or permit the sharing of any User Content, to remove any User Content from the Service, and to prevent the uploading, storage, or sharing of any User Content.