Yeah you are right it won't be a problem but to be safe(Reverse leads due to junk traffic by advertisers) PPD is better for such niches.But if he only locks the password.txt file then it would be more beneficial to use content locking, no? I mean, the CPA company doesn't know what file does the password belongs to, and the user gets what he completed the survey for (the password in this case) so there shouldn't be any problem, right?