Why can't I use robots.txt to block my file?

If you use robots.txt, Google will not crawl a page; however, if it finds a link to your page on another site, with descriptive text, it might generate a search result from that. If you have included a “noindex” tag on the page, Google won’t see it, because Google must crawl (fetch) the page in order to see that tag, but Google won’t fetch your page if there’s a robots.txt file blocking it! Therefore, you should let Google crawl the page and see the “noindex” tag or header. It sounds counterintuitive, but you need to let Google try to fetch the page and fail (because of password protection) or see the “noindex” tag  to ensure it’s omitted from search results.

This does not apply to images; for images, robots.txt is the correct way to block images from search results.
Source: https://support.google.com/webmasters/answer/6332384?rd=1