XOR is most certainly not secure
If you know what the file type is (which you can probably work out pretty easily if most of it isn't encrypted) then the first few bytes are known. Doesn't matter if the mask is random or not, you've got the first few bytes and you didn't even have to brute force them! Hardly secure.