Time to create empty wallet.dat files and sell to this guy. Or create wallet.dat with really good and long password, send coins there, sell the wallet.dat and later at some point transfer coins to more secure, private wallet.

It is possible to find password using dictionary or brute force if the password is short. But the flaw in his business plan is in logic and possible abuse from seller.