Because it means with <single piece of secret info>, your entire customer base's worth of passwords is now decrypted. You've now gone from "Even if we get atta

Because it means with <single piece of secret info>, your entire customer base's worth of passwords is now decrypted. You've now gone from "Even if we get attacked, we've chosen a provably difficult / secure storage method. The damage should be negligible." to "If we get attacked - I hope like hell they don't get <single piece of secret info>." An attack is an attack. If they can get in and steal your password database, what's to say that they can't get access to the key that decrypts your reversible database?